Best practice: /etc/shadow, /etc/sudoers

[frlan]

Hi folks,

What do you think is best practice to have files like /etc/shadow, which area only readable by root for good reasons, also being checked against changes?

[PhilSynek]

I know this thread is old, but I will answer this question for everybody who has the same problem.

If it doesn't violate your security policy, you can simply add the user zabbix to the group shadow:

usermod -G shadow zabbix

The user zabbix will then have read permission for /etc/shadow

Greetings,
Phil

[Darius256]

Hi there. You can do this in a workaround: manually or through crontab through a privileged user - save the hash /etc/shadow in a text document, and check back the fact that this file has changed.

Bash
for example(it's worked):

sha256sum /etc/shadow > /your/path/hashfile
chown zabbix:zabbix /your/path/hashfile && chmod 400 /your/path/hashfile

Then create an item:

fs.file.cksum[/path/hashfile]

(change "/your/path/hashfile" to the path to your hashfile)


And trigger:

{yourtemp:vfs.file.cksum[/path/hashcheck].diff ()}> 0

(change "yourtemp" - your template/host name and "/path/hashcheck" - your path to hash file)