Detections
Analytics

5.4.2.7 Ensure system accounts do not have a valid login shell

Information

There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell.

A system account that retains a valid login shell provides an interactive foothold for anyone who obtains its credentials. Removing the login shell from accounts that do not need interactive access eliminates that foothold.

Solution

Run the following command to set the shell for any service accounts returned by the audit to nologin :

# usermod -s $(command -v nologin) <user>

Example script:

#!/usr/bin/env bash

{
 l_valid_shells="^($(awk -F\/ '($NF != "nologin" && $NF != "false") {print}' /etc/shells | sed -rn '/^\//{s,/,\\\\/,g;p}' | paste -s -d '|' - ))$"
 awk -v pat="$l_valid_shells" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' || $3 == 65534) && $(NF) ~ pat) {system ("usermod -s '"$(command -v nologin)"' " $1)}' /etc/passwd
}

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION

References: 800-53|AC-2(5), 800-53|AC-3, 800-53|AC-11, 800-53|IA-5, 800-53|MP-2, CSCv7|16.8

Plugin: Unix

Control ID: fb3f87dec6a3a00dbebc0d68e25d9e6d55760c9d5d347450dca6475ffd2fda86