RHEL 9 /etc/shadow file must be owned by root.

Documentable No

Rule ID SV-257910r991589_rule

CCI References

CCI-000366

Discussion

The "/etc/shadow" file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information, which could weaken the system security posture.

Check Procedure

Verify the ownership of the "/etc/shadow" file with the following command:

$ sudo stat -c "%U %n" /etc/shadow

root /etc/shadow

If "/etc/shadow" file does not have an owner of "root", this is a finding.

Fix Action

Change the owner of the file /etc/shadow to root by running the following command:

$ sudo chown root /etc/shadow