# Ensure accounts in /etc/passwd use shadowed passwords

Necessity: Storing password hashes in the world-readable '/etc/passwd' file is a critical security vulnerability. Any user with local access can read these hashes and subject them to offline brute-force or rainbow table attacks to discover user passwords. Using shadowed passwords moves the sensitive hashes to the '/etc/shadow' file, which is protected and only readable by the root user, significantly mitigating this risk. This is a foundational security measure for any Linux system.

Auditing and Remediation: The audit script inspects the '/etc/passwd' file to find any accounts that do not use the 'x' placeholder in the password field, which indicates an unshadowed password. The remediation script executes the 'pwconv' utility, a standard system tool designed specifically to create and synchronize the '/etc/shadow' file from '/etc/passwd', thereby securing the password hashes.

Recommended State Rationale: There is no acceptable scenario for having unshadowed passwords. The only secure configuration is for all accounts to have their password hashes stored in '/etc/shadow'. Therefore, the recommended state for Basic, Moderate, and Strict levels is identical: the count of non-compliant accounts must be zero. Any value greater than zero represents a direct and exploitable vulnerability, making a tiered recommendation inappropriate for this fundamental security control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that counts the number of user accounts in the '/etc/passwd' file whose password field (the second field, delimited by colons) is not 'x'. The script must return only the resulting integer count.

## Remediation Script Working

Bash script that executes the 'pwconv' command to convert any non-shadowed passwords into shadowed passwords by moving the password hashes from '/etc/passwd' to '/etc/shadow'. The script does not need to accept any command-line arguments. It must return 'true' upon successful execution of 'pwconv' and 'false' otherwise.

