CriticalOS hardeningBLWK-FS-002

/etc/shadow is world-readable

What this means

/etc/shadow (mode ‹mode octal›) is readable by any local user. It holds every account's password hash — world-readable turns any local foothold into an offline password-cracking opportunity against every account on the box.

How to fix it

chmod 640 /etc/shadow (or your distro's default — verify with stat /etc/shadow on a known-good system).

Check it yourself

Run a scan and look for BLWK-FS-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_permissions and reports this check when:

path == "/etc/shadow" and world_readable == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 6.1.2
• MITRE ATT&CK T1003.008

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001