<Group id="password_storage">
<title>Proper Storage and Existence of Password Hashes</title>
<description>
By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<tt>/etc/shadow</tt>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <tt>/etc/passwd</tt>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.
</description>

<Rule id="no_empty_passwords" severity="high">
<title>Log In to Accounts With Empty Password Impossible</title>
<description>If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the <tt>nullok</tt>
option in <tt>/etc/pam.d/system-auth</tt> to
prevent logins with empty passwords.
</description>
<ocil clause="NULL passwords can be used">
To verify that null passwords cannot be used, run the following command:
<pre># grep nullok /etc/pam.d/system-auth</pre>
If this produces any output, it may be possible to log into accounts
with empty passwords.
</ocil>
<rationale>
If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational
environments.
</rationale>
<oval id="no_empty_passwords" />
<ref nist="IA-5(b),IA-5(c),IA-5(1)(a)" />
</Rule>

<Rule id="no_hashes_outside_shadow" severity="medium">
<title>Password Hashes For Each Account Shadowed</title>
<description>
If any password hashes are stored in <tt>/etc/passwd</tt> (in the second field,
instead of an <tt>x</tt>), the cause of this misconfiguration should be
investigated.  The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.
</description>
<ocil clause="any stored hashes are found in /etc/passwd">
To check that no password hashes are stored in
<tt>/etc/passwd</tt>, run the following command:
<pre># awk -F: '($2 != "x") {print}' /etc/passwd</pre>
If it produces any output, then a password hash is
stored in <tt>/etc/passwd</tt>.
</ocil>
<rationale>
The hashes for all user account passwords should be stored in
the file <tt>/etc/shadow</tt> and never in <tt>/etc/passwd</tt>,
which is readable by all users.
</rationale>
<oval id="accounts_password_all_shadowed" />
<ref nist="IA-5(h)" disa="201" />
</Rule>

<Rule id="gid_passwd_group_same">
<title>All GIDs referenced in /etc/passwd Defined in /etc/group</title>
<description>
Add a group to the system for each GID referenced without a corresponding group.
</description>
<ocil clause="there is output">
To ensure all GIDs referenced in <tt>/etc/passwd</tt> are defined in <tt>/etc/group</tt>,
run the following command:
<pre># pwck -qr</pre>
There should be no output.
</ocil>
<rationale>
Inconsistency in GIDs between <tt>/etc/passwd</tt> and <tt>/etc/group</tt> could lead to a user having unintended rights.
</rationale>
<ref disa="366" />
</Rule>

<Rule id="no_netrc_files" severity="medium">
<title>netrc Files Do Not Exist</title>
<description>The <tt>.netrc</tt> files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used.  Any <tt>.netrc</tt> files should be removed.
</description>
<ocil clause="any .netrc files exist">
To check the system for the existence of any <tt>.netrc</tt> files,
run the following command:
<pre># find /home -xdev -name .netrc</pre>
<!-- needs fixup to limit search to home dirs -->
</ocil>
<rationale>
Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
files. DoD policy requires passwords be encrypted in storage and not used
in access scripts.
</rationale>
<oval id="no_netrc_files" />
<ref nist="IA-5(h)" disa="196" />
</Rule>

</Group>
