3.3 Ensure the Apache User Account Is Locked

Information

The user account under which Apache runs should not have a valid password, but should be locked.

Rationale:

As a defense-in-depth measure, the Apache user account should be locked to prevent logins and to prevent a user from 'su'-ing to 'apache' using the password. In general, there shouldn't be a need for anyone to have to 'su' as 'apache', and when there is a need, 'sudo' should be used instead, which would not require the 'apache' account password.

Solution

Use the 'passwd' command to lock the 'apache' account:

# passwd -l apache

See Also

https://workbench.cisecurity.org/files/2378