7.1.5 Ensure permissions on /etc/shadow are configured

Audit#

Run the following command to verify /etc/shadow is mode 640 or more restrictive, Uid is 0/root and Gid is 0/root:

# stat -Lc 'Access: (%#a/%A) Uid: ( %u/ %U) Gid: ( %g/ %G)' /etc/shadow

Example:

Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)

Run one of the following commands to set ownership of /etc/shadow to root and group to either root or shadow:

# chown root:shadow /etc/shadow
-OR-
# chown root:root /etc/shadow

Run the following command to remove excess permissions form /etc/shadow:

# chmod u-x,g-wx,o-rwx /etc/shadow

Default Value: Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 42/ shadow)