A corporate server security policy states, "Ensure password hashes are not readable by non- administrative users." The administrator should check the permissions on which of the following files to…

The correct answer is A. /etc/shadow. /etc/shadow stores the actual hashed passwords for all user accounts, along with password aging information. By default it is owned by root with permissions 000 or 640, making it unreadable by non-administrative users - exactly what the policy requires. /etc/passwd is…

Security

Question

A corporate server security policy states, "Ensure password hashes are not readable by non- administrative users." The administrator should check the permissions on which of the following files to ensure the server satisfies this policy?

Options

A/etc/shadow
B/etc/passwd
C/etc/group
D/etc/security/limits.conf

How the community answered

(54 responses)

A
94% (51)
B
2% (1)
D
4% (2)

Explanation

/etc/shadow stores the actual hashed passwords for all user accounts, along with password aging information. By default it is owned by root with permissions 000 or 640, making it unreadable by non-administrative users - exactly what the policy requires. /etc/passwd is world-readable but only contains a placeholder 'x' (not the actual hash) in the password field. /etc/group stores group membership information, and /etc/security/limits.conf defines resource limits. Only /etc/shadow holds the sensitive password hashes that must be protected.

Topics

#Linux security#File permissions#Password management#/etc/shadow file

Community Discussion

No community discussion yet for this question.

Full XK0-005 Practice