Detections
Analytics

4.5.2.3 Ensure system accounts are secured

Information

Several accounts are provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts not intended to provide an interactive shell.

It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the nologin shell. This prevents the account from potentially being used to run any commands.

Solution

System accounts

Set the shell for any accounts returned by the audit to nologin :

# pw usermod -s $(command -v nologin) <user>

Disabled accounts

Lock any non-root accounts returned by the audit:

# pw lock <user>

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-2(5), 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AC-11, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 9e753e8f6bcd603cdecb34d6312b12d5dbaaa44031a769c47a6a284835bd4447