Detecting and Containing Unauthorized Modification of Linux /etc/passwd Through SHA-256 Cryptographic Integrity Verification and Automated Incident Response

Enterprise Linux servers maintain critical authentication and system configuration files that directly influence user access and system security. The Linux /etc/passwd file contains essential account information used by the operating system for user identification and account management.

Unauthorized modification of /etc/passwd can indicate malicious activity, account manipulation, or an attempt to alter the authentication environment. If such modification is not detected quickly, an attacker may continue operating with unauthorized account privileges or manipulate the server's user configuration.

In this use case, a controlled enterprise-like Linux environment is created using Ubuntu virtual machines. The /etc/passwd file is treated as a protected critical configuration file.

A cryptographic integrity baseline is established by calculating the SHA-256 hash of the protected file. The baseline hash represents the expected integrity state of the file.

A controlled file-tampering simulation is then performed within the isolated laboratory environment. The /etc/passwd file is intentionally modified in a controlled manner to generate a detectable integrity change. No real account takeover or destructive modification is performed.

Wazuh is configured to monitor the protected file and detect the unauthorized modification. The cryptographic integrity value is compared against the established baseline to identify a hash mismatch.

When unauthorized modification is detected, Wazuh generates a security alert. Wazuh Active Response is then used to execute the predefined containment action.

The modified file is subsequently investigated and restored to its known-good state. The SHA-256 hash is recalculated to confirm that the original integrity has been recovered.

The Linux /etc/passwd file stores essential information about local user accounts on a Linux system. Because this file is involved in account management, unauthorized modification can affect the security state of the server.

Traditional monitoring may identify that a file has changed, but a security system must also determine whether the current file state matches the previously trusted state. Without cryptographic integrity verification, unauthorized modifications to critical configuration files may remain unnoticed until they produce visible authentication or system-level consequences.

Unauthorized modification of /etc/passwd can change the integrity state of a critical authentication configuration file and may lead to potential account manipulation or continued unauthorized activity.

The security problem is therefore:

The proposed solution introduces SHA-256 cryptographic integrity verification combined with Wazuh File Integrity Monitoring and automated incident response to detect and contain unauthorized modification of /etc/passwd.

The attack scenario simulates unauthorized modification of the Linux /etc/passwd file. A controlled laboratory modification is performed against the protected file so that the cryptographic integrity monitoring mechanism can identify the change.

The simulation does not create unauthorized real-world access or compromise a production authentication system. The purpose is to reproduce the file-tampering behavior and validate whether the security system can detect the integrity violation and initiate the appropriate response.

The primary security concept is cryptographic integrity verification using SHA-256.

A SHA-256 hash is generated from the trusted /etc/passwd file and stored as the baseline integrity value. When the file is modified, its SHA-256 hash changes. The current hash is compared with the trusted baseline.

The secure processing flow is:

A matching hash indicates that the monitored file content remains unchanged. A different hash indicates that the file content has changed and requires security investigation.