Tiger 2.2.4p1 Security Audit

[Pclinuxguru]

I ran a security Audit on my RH 7 server and it found problems with my /etc/passwd file.

It says the accounts are disabled but still have valid shells. If it was one or 2 I would just fix it but it says that for ALL the accounts listed. I do shadow the paswords to /etc/shadow and from viewing that file it looks normal. All normal users have no problem logging in... Here is an example entry... this is the root entry and I can log in as root and do stuff normally expected of the root account.

# Performing Check of user account .....
#Checking Accounts from /etc/passwd
--WARN-- [acc001w] Login ID root is disabled, but still has a valid shell

Here is the root entry in /etc/passwd:

root:x:0:0:root:/root:/bin/bash

It also checked the passwd files and the group files and reported no problems....

I ran pwck and it reported no problems with the shadow or the passwd....

Any suggestions as to why Tiger is reporting this?

[chsh]

Is there an option within Tiger to tell it to look for /etc/shadow as the password file, rather than /etc/passwd? It's possible that because you use (as most linux distros do nowadays) /etc/shadow that Tiger thinks the accounts are disabled (due to the user:x:100 etc) style of the /etc/passwd file. It knows that a single character isn't a valid password hash, so it thinks the account has been disabled. See if there's options to enable checking of /etc/shadow, or see if there's mention of it anywhere in the documentation. If not, try contacting their support or whomever developed it, and see if they can give you a straight answer.

Most likely, it's the /etc/shadow thing throwing the auditing software off.

[souleman]

When tiger says that an account is disabled, it normally means that the password is in a shadow file. Since the /etc/passwd file is readable by all, that is a good thing. The reason it says that it still has a valid shell is because there is still the /bin/bash part of the file. Certain accounts should be completely disabled, and NOT have a valid shell. I believe that tiger is just giving you a warning about your current state. It isn't saying that you have to fix something, it is just saying to make sure you look into it.

Then again, I haven't used tiger in a long time, so I could be mistaken.

[Pclinuxguru]

Thanks guys... I couldn't find any documentation on it. I was thinking along the lines of what chsh said but I wanted to be sure. I guess I assumed that the makers of Tiger would have assumed that there was a shadow file for passwords. I did check the password checking script and it apparently it tries to merge the files for a Crack run then saves that file. I don't use or need crack for what I need on this server becasue I know all the passwords.