Detections
Analytics

1.406 OL09-00-003051

Information

OL 9 system accounts must not have an interactive login shell.

GROUP ID: V-271845
RULE ID: SV-271845r1092247

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure OL 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them.

If the system account needs a shell assigned for mission operations, document the need with the ISSO.

Run the following command to disable the interactive shell for a specific noninteractive user account:

Replace <user> with the user that has a login shell.

$ sudo usermod --shell /sbin/nologin <user>

Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-271845r1092247_rule, STIG-ID|OL09-00-003051, Vuln-ID|V-271845

Plugin: Unix

Control ID: 56f33b2f30b3e71e1ca7e89bc10ce002757ea7b60f66e9cd5b2c6615deebb732