security hole on /etc/passwd

[Hanry Zhou]

By default, the permission on /etc/passwd is 444, and that would pose a securit issue if an orderary user get the encrypted password from the file, and using some type of tool to crack it.

So, I would really suggest HP to change it's permission to maybe "440".

changing the system to trusted system maybe a solution, but in many cases, users may not want to do that.

any opinion on that?

[Robert-Jan Goossens]

Hi,

Yes, install shadow passwd.

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Hope this helps,
Robert-Jan

[Tomek Gryszkiewicz]

Not a very good idea to change the permission of passwd - is should be readable by every process.
Install some kind a shadow password (eg. change system to trusted) - there the passwords are not kept in /etc/passwd

-Tomek

[Todd McDaniel_1]

IIRC, you cant make it 440 b/c no user would be able to login if their profile couldnt read the passwd file.

passwd file MUST be readable by all... that is an inherent weakness of UNIX. but as stated can be fixed with shadow file

OR as my company does we use 1-time password convention known as SecurID cards.

[Hanry Zhou]

Tomek,

As I said already, under some circumstances, user don't want to change it to trusted systems.

What specifica problem it would cause if we change the permission to "440"?

[Hanry Zhou]

Todd,

I test it, and I am able to log in under "440".

[Paul F. Carlson]

Just out of curiosity, what are the circumstances where you wouldn't want to convert to trusted system?

[John Poff]

Hi,

Now that you've changed permissions on your password file to 440, do an 'ls -l' and see if it lists your login name as owning files, or just the UID.

JP

[Hanry Zhou]

JP,

If I change it to 440, and log in as an ordenary user, I can see the file /etc/passwd is still owned by "root:sys".

Do I miss understand your question?

[Robert-Jan Goossens]

Hanry,

# chmod 440 /etc/passwd
# su - normal_user
# ls -la /home/normal_user
and look at the group-id of the files.

Regards,
Robert-Jan

[Rodney Hills]

If you are concerned about crackers, then implement "PAM" to validate passwords through a more secure method.

HTH

-- Rod Hills

[Patrick Wallek]

If you change /etc/passwd to 440 permissions, and log in as a regular user, then ls will NOT be able to resolve UIDs to actual user names.

Here is what happens when a regular user uses 'ls -la' on their home directory with /etc/passwd permissions at 440:

[ wallekp@ftp:/home/wallekp ]
$ ls -la
total 144
drwx------ 4 102 users 8192 Sep 29 2003 .
drwxr-xr-x 12 0 root 8192 Apr 29 09:39 ..
-r--r--r-- 1 102 users 832 Nov 14 2000 .cshrc
-r--r--r-- 1 102 users 347 Nov 14 2000 .exrc
-r--r--r-- 1 102 users 334 Nov 14 2000 .login
-rw------- 1 102 users 455 May 1 2003 .profile
-rw-r--r-- 1 102 users 347 May 27 2003 .pw_profile
-rw------- 1 102 users 2192 Jun 9 10:17 .sh_history
drwx------ 2 102 users 8192 May 8 2003 .ssh
drwx------ 5 0 root 96 Sep 29 2003 .sw

You are correct in that 444 permissions is not necessarily a good idea, but neither is changing permissions to 440.

The ideal is to convert to either a trusted system, or install the shadow password bundle and use /etc/shadow for the passwords.

As far as why you would not want to convert to trusted -- There are still some application vendors that say that their application will not work with a trusted system.

[John Poff]

Try the steps that Robert-Jan described. It is an example of the simple things that will break when you make the /etc/passwd file unreadable by the rest of the world.

As mentioned previously, the best way to secure the password file is to convert to a trusted system, or at least to shadow passwords. I think you can convert to shadow passwords without converting completely to a trusted system.

JP

[Patrick Wallek]

In my ls example above, note that the 3rd column where the file owner is lists only the UID number rather than the user name.

[Geoff Wild]

You can install shadow passwords for HP-UX 11i:

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=ShadowPassword

Rgds...Geoff

[Steven E. Protter]

Going trusted or shadow will merely move the password to a shadow file or many little shadow files in the case of trusted.

That just makes it a chore to get to them.

Changing the permissions on the /etc/passwd file or the shadow file or the trusted password files without direction from HP is simply not a good idea.

I haven't seen a security bulliten on it and won't take action without HP's blessing. Its just too big to touch.

SEP

[Hanry Zhou]

Patrick W.

I test it on both 11.0 and 11.11 system, and did find the userid not being able to be transfered to the acutal name, although gid is okay.

however, on the 11.11 system, everything seems okay, userid and groupid are all alright even though I changed passwd to 440.

[Geoff Wild]

At 440 - can a user change their password?

Rgds...Geoff

[Todd McDaniel_1]

yes you can change pw with 440 just did it on a workstation.

[John Poff]

A regular user can change their password even with the /etc/passwd file permissions set at 440, because the /usr/bin/passwd program is a setuid program which executes as the root user when you run it.

JP