Other Articles

Servers – Ensure Shadow Group Has No Members

Secure Configuration Checks > Server

This check ensures that no users are assigned to the shadow group.

The shadow group provides read access to the /etc/shadow file, which contains hashed passwords and sensitive account information. Any user in this group can potentially compromise system security.

Check Details

  • Resource: Server
  • Check: Ensure shadow group is empty
  • Risk: Users in the shadow group can read the /etc/shadow file, allowing attackers to attempt password cracking and gain unauthorized access.

Remediation Steps

  1. Open a terminal session on the server with root or sudo privileges.

  2. Identify users assigned to the shadow group using the following command:

    grep ^shadow:[^:]*:[^:]*:[^:]+ /etc/group

  3. Check if any users have the shadow group as their primary group:

    awk -F: '($4 == "<shadow-gid>") { print }' /etc/passwd

  4. Remove users from the shadow group (secondary group membership):

    gpasswd -d <username> shadow

  5. If any user has shadow as their primary group, change it to a safe group:

    usermod -g <new_primary_group> <username>

  6. Verify that the shadow group has no members:

    grep ^shadow /etc/group
  7. Ensure the output shows no users listed after the group entry.
  8. Implement regular audits to ensure no users are added to the shadow group in the future.

Updated on 06 March, 2026