Detections
Analytics

1.196 ALMA-09-024990

Information

AlmaLinux OS 9 system accounts must not have an interactive login shell.

GROUP ID: V-269300
RULE ID: SV-269300r1050182

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure AlmaLinux OS 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them.

If the system account needs a shell assigned for mission operations, document the need with the ISSO.

Run the following command to disable the interactive shell for a specific noninteractive user account, replacing <user> with the user that has a login shell.

$ usermod --shell /sbin/nologin <user>

Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-269300r1050182_rule, STIG-ID|ALMA-09-024990, Vuln-ID|V-269300

Plugin: Unix

Control ID: ea76458aad28ce63d9d24929b97e515c3f8135ea271293e25a11a756de28877d