Rule ID
SV-45006r1_rule
Version
V1R12
CCIs
The /etc/shadow file contains the list of local system accounts. It is vital to system security and must be protected from unauthorized modification. The file also contains password hashes which must not be accessible to users other than root.
Verify /etc/shadow has no extended ACL. # ls -l /etc/shadow If the permissions include a '+', the file has an extended ACL. If the file has an extended ACL and it has not been documented with the IAO, this is a finding.
Remove the extended ACL from the file. # setfacl --remove-all /etc/shadow