6.2.2 Ensure no legacy '+' entries exist in /etc/passwd - + entries exist in /etc/passwd

Information

The character + in various files used to be markers for systems to insert data from NIS maps at a certain point in a system configuration file. These entries are no longer required on most systems, but may exist in files that have been imported from other platforms.

Rationale:

These entries may provide an avenue for attackers to gain privileged access on the system.

Solution

Remove any legacy '+' entries from /etc/passwd if they exist.

See Also

https://workbench.cisecurity.org/files/3738

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Unix

Control ID: ec0e898e588f924147c8ae822aeb53abaf7fa71b2240e2b70dbe6e452b7dda24