Password file issues

Passwords are, of course, an important part of security, but aside from imposing password creation restrictions, administrators can overlook password maintenance. This tip from Aeleen Frisch's book Essential System Administration, published by O'Reilly Associates, gives some advice for maintaining the integrity of password files.

It is important to examine the password file regularly for potential account-level security problems, (as well as the shadow password file when applicable). In particular, it should be examined for:

* Accounts without passwords.

* UIDs of 0 for accounts other than root (which are also superuser accounts).

* GIDs of 0 for accounts other than root. Generally, users don't have group 0 as their primary group.

* Accounts added or deleted without your knowledge.

* Other types of invalid or improperly formatted entries.

* The file's own ownership and permissions.

Under System V, SunOS and Linux (via shadow package), the pwck command will perform some simple syntax checking on the password file and can identify some security problems with it (AIX provides the very similar pwdck command to check its several user account database files). pwck will report on invalid usernames (including null ones), UIDs and GIDs, null or nonexistent home directories, invalid shells and entries with the wrong number of fields (often indicating extra or missing colons and other typos). However, it won't find a lot of other, more serious security problems. You'll need to check for those periodically in some other manner. (The grpck command performs similar simple syntax checking for the /ect/group file.)