Audit a machine from its account files

short · 20 min · Objective 2.2

Task

Answer the four questions every auditor asks, using the account files directly rather than the management commands: who can log in, who has administrative rights, which accounts have no password, and which have never been used.

Doing it from the files rather than the tools is the point -- it is faster, it works when the tools are missing, and it is what you fall back on when a management command gives an answer you do not believe.

Steps

List every account that has a real login shell, excluding those set to nologin or false. That is the set of accounts a person could use.
Find every account with UID 0. There should be exactly one, called root.
Find accounts with an empty password field in /etc/shadow -- these authenticate with no password at all and are a finding, not a curiosity.
Distinguish locked accounts from those that simply never had a password: a leading ! is locked, a bare * means password login was never enabled.
Read lastlog and identify accounts that have never logged in. A live account with no login history is a candidate for removal.
Pick one ordinary user and confirm, with id, that their primary group does not appear in their /etc/group line -- the discrepancy that makes grepping the group file misleading.

Verify

awk -F: '$7 !~ /(nologin|false)$/ {print $1}' /etc/passwd
awk -F: '$3 == 0 {print $1}' /etc/passwd            # exactly "root"
sudo awk -F: '$2 == "" {print $1}' /etc/shadow      # must be empty
sudo awk -F: '$2 ~ /^!/ {print $1}' /etc/shadow | head
lastlog | grep -i "never logged in" | head

The second command must print exactly one line. If it prints two, you have found a second root account under another name, and that is an escalation rather than a note.

Notes

getent passwd rather than reading /etc/passwd is the correct habit on any machine joined to a directory -- the local file will simply not contain most of your users, and an audit that reads it alone reports a comfortingly short list.