I've been challenged with auditing a systems security on a scenario and giving various areas we have to audit. Most of which were easy to understand and to provide vulnerabilities as well as mitigating them. However One of them is usernames, in which I have no clue whatsoever. I was guided and told to use sudo su and less /etc/passwd to see a list of usernames, easy enough.
The only potential vulnerability is that you can't crack/use a password to gain access to an account if you don't have a username, so what could anyone do to mitigate that? It's had me stumped for weeks.
sudo suyou already have full control over the system): could you see the password hashes? Keeping them in
/etc/shadowcould be considered a vulnerability.
---------. /etc/shadow. So any user of the system can see
/etc/passwdand get the list of users and their details, but even the password hashes are only readable by root. In that case, an upvote for Phill Lello's answer for using an off-board authentication server so that there's nothing to see in
passwd, though: you can probably infer usernames from
/etc/group, you can see logged-in users through /var/run/utmp and utilities that use it (who, finger, pinky, etc.), you may be able to infer some usernames from
/procentries. Usernames probably get leaked in plenty of other places, too: on UNIX systems there is generally the assumption that, if you already have an account, you can see who else has an account. It's doable but there's a lot of work and you have to dot all your