Detections
Analytics

2.2.3 Ensure the NGINX service account has an invalid shell - script

Information

The nginx account should not have the ability to log in, so the /sbin/nologin shell should be set for the account.

Rationale:

The account used for nginx should only be used for the nginx service and does not need to have the ability to log in. This prevents an attacker who compromises the account to log in with it.

Solution

Change the login shell for the nginx account to /sbin/nologin by using the following command:

usermod -s /sbin/nologin nginx

Default Value:

The nginx user has a shell of /sbin/nologin by default on RHEL systems.

See Also

https://workbench.cisecurity.org/files/4212

Item Details

References: CSCv7|5.1

Plugin: Unix

Control ID: 097993326a6041efdaf6e69bb42da075701edaa243fbb2dd557d9f54c379612d