Other Articles

Servers – Ensure Shadow Group Has No Members

Support > Fixing Checks > Server

06 March, 2026

This check ensures that no users are assigned to the shadow group.

The shadow group provides read access to the /etc/shadow file, which contains hashed passwords and sensitive account information. Any user in this group can potentially compromise system security.

Check Details

  • Resource: Server
  • Check: Ensure shadow group is empty
  • Risk: Users in the shadow group can read the /etc/shadow file, allowing attackers to attempt password cracking and gain unauthorized access.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Identify users assigned to the shadow group using the following command:

    grep ^shadow:[^:]*:[^:]*:[^:]+ /etc/group

  3. Check if any users have the shadow group as their primary group:

    awk -F: '($4 == "<shadow-gid>") { print }' /etc/passwd

  4. Remove users from the shadow group (secondary group membership):

    gpasswd -d <username> shadow

  5. If any user has shadow as their primary group, change it to a safe group:

    usermod -g <new_primary_group> <username>

  6. Verify that the shadow group has no members:

    grep ^shadow /etc/group
  7. Ensure the output shows no users listed after the group entry.
  8. Implement regular audits to ensure no users are added to the shadow group in the future.