---
title: "HOST-USR-009 Password and Shadow Files Out of Step"
canonical: https://openvapt.com/checks/HOST-USR-009.html
html: https://openvapt.com/checks/HOST-USR-009.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-USR-009 Password and Shadow Files Out of Step

Checks that every /etc/passwd account has a /etc/shadow entry, that no password hash sits in /etc/passwd, and that /etc/shadow has no orphan entries.

- Domain: Server
- Severity: Medium
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-256, CWE-522
- NIST SP 800-53 Rev. 5: IA-5, AC-2
- Benchmark topic: passwd and shadow consistency (topic only, no benchmark text)

## Why It Matters

A hash in the world-readable /etc/passwd can be cracked offline by any user. An account with 'x' in passwd but no shadow line has an undefined password state that differs between tools, and shadow lines for deleted accounts are leftovers of a removal that did not finish.

## How It Detects

Reads /etc/passwd and /etc/shadow (root only) and reports accounts missing from shadow, passwd password fields other than x, *, ! or empty, and shadow entries with no passwd account.

## How to Fix

pwconv  moves hashes into /etc/shadow and creates missing entries; userdel or vipw/vigr removes orphan lines; run pwck and grpck to confirm the files are consistent.

## How to Verify

```
pwck -r  reports no errors.
```

## Learn the Theory

- [P7 Identity, Passwords and Privilege](https://openvapt.com/academy/p7.md)
- [P15 Access Control: Accounts, Sudo and Logins](https://openvapt.com/academy/p15.md)
- [P20 Secrets, Cron and Account Hygiene](https://openvapt.com/academy/p20.md)

## References

- [shadow(5), Linux man-pages](https://man7.org/linux/man-pages/man5/shadow.5.html)
- [passwd(5), Linux man-pages](https://man7.org/linux/man-pages/man5/passwd.5.html)
- [pwck(8), Linux man-pages](https://man7.org/linux/man-pages/man8/pwck.8.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go

Run it: `openvapt scan --only HOST-USR-009`. Read it offline: `openvapt explain HOST-USR-009`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-USR-009.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.