# Ensure accounts in /etc/passwd use shadowed passwords

Necessity: Storing password hashes in the publicly readable `/etc/passwd` file exposes them to all local users, making them vulnerable to offline brute-force or dictionary attacks. The shadow password system mitigates this risk by moving the password hashes to the `/etc/shadow` file, which is only readable by the root user. Ensuring that all accounts use shadowed passwords is a fundamental security control for protecting user credentials.

Auditing and Remediation: The audit script verifies the system-wide status of the shadow password feature by checking its configuration. The remediation script uses the `pwconv` utility, which creates `/etc/shadow` from `/etc/passwd` and replaces the encrypted passwords in `/etc/passwd` with a placeholder 'x', effectively enabling the shadow password system.

Recommended State Rationale: This setting is a binary security control; it is either secure ('on') or insecure ('off'). There is no middle ground or less-secure-but-acceptable configuration. Therefore, the recommended state for all hardening levels (Basic, Moderate, and Strict) is 'on'. Disabling shadow passwords represents a critical security vulnerability and is not recommended under any circumstances on a modern system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['on']` |
| **Moderate** | `['on']` |
| **Strict** | `['on']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if shadow passwords are in use. The script should parse the output of 'shadowconfig --status' and return only the string 'on' if enabled, or 'off' if disabled.

## Remediation Script Working

bash script that accepts a single argument. If the argument is 'on', the script must execute the `pwconv` command to enable shadow passwords. The script must return `true` upon successful execution or `false` on failure.

