Skip to content

0004-user-passwd-exist - /etc/passwd Does Not Exist on Host

Rule ID

  • 0004-user-passwd-exist

Category

  • system

Severity

  • critical

Compatible Versions

  • Linux

Description

  • Monitors whether the /etc/passwd file exists on the host.

Scan Frequency

  • 1 */5 * * *

Rationale

  • In Linux, the /etc/passwd file contains a corresponding record line for each user, recording basic user attributes. System administrators often modify this file to manage users. The deletion of /etc/passwd can prevent host login and is considered malicious destruction.

Risk Items

  • Hacker infiltration

  • Data leakage

Audit Method

  • Verify whether /etc/passwd exists on the host. Execute the following command to verify:
ls /etc/passwd

Remediation

  • If /etc/passwd is deleted but the system has not been rebooted, execute the following command to recover:
cp /etc/passwd
/etc/passwd

If the system has been shut down after deleting the file, you will be unable to log in at startup.

Press e during GRUB boot to enter edit mode. On the linux16 line, change ro to rw rd.break.

Press Ctrl+x to execute.

After entering single-user mode, change the root path and copy the init program:

```bash chroot /sysroot

cp /etc/passwd /etc/passwd 

Because the security context of the copied file does not match the current directory, you need to disable SELinux:

```bash
vim /etc/sysconfig/selinux

selinux = disabled

Type exit twice to exit the current root and reboot the host. The system will return to normal.

Impact

  • None

Default Value

  • None

References

CIS Controls

  • None

Feedback

Is this page helpful?