0006-user-passwdstatus-Host User Password Status Changed¶

Rule ID¶

• 0006-user-passwdstatus

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor host user password status changes

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• Account password status includes three states: LK (password locked), NP (no password set), PS (password set). Host account password status information is critical for host user login. If the account password status is changed due to unknown operations, attention should be paid to whether the host environment has been compromised.

Risk Items¶

• Hacker infiltration

• Data breach

• Network security

• Cryptomining risk

• Botnet risk

Audit Method¶

• Verify whether the host account password status has been illegally modified. You can verify by executing the following command:

ls -l /etc/shadow

Remediation¶

• If the host account password status is illegally modified, be sure to carefully check the host environment for compromise and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None