Detect passwords or empty passwords in Docker images' /etc/shadow files

[huornlmj]

Description

If a Docker image has either of the following in its /etc/shadow file then it can mean that there is either a hard coded password or an empty account password.

root:::0:::::

or

root:$y$j9T$MfMQyyvhU0VftFUhpmkUS/$pPrE9qJcAx6Ac6hL5ovoMZRXoleaaex.jSZBs3iy3.1:19775:0:99999:7:::

Or if it is not the following:

root:!:::::::

Such an instance should be found as part of Trivy's image scanning with the secrets scanner enabled.

Target

Container Image

Scanner

Secret

[itaysk]

thanks for the suggestion. just to clarify, this isn't a secret (password) that was left exposed unintentionally, but rather a misconfiguration that indicates a bad practice, correct? just want to properly classify the request

[huornlmj]

It could be unintentional (accidental from the developer) or intentional (bad practice) or malicious.

[knqyf263]

Same request?
#3798

[huornlmj]

No I don't think this is the same as a weak password specifically for SSH. It's more broad than that.

[knqyf263]

It's not limited to SSH. The PR tries to scan /etc/shadow, /etc/disc.conf, etc., for weak passwords.

[huornlmj]

But will it detect root:::0::::: as weak?

[knqyf263]

I'm not sure if weak passwords include an empty one or not.