Detections
Analytics

5.4.2.8 Ensure accounts without a valid login shell are locked

Information

There are a number of accounts provided with most distributions that are used to manage applications. Additionally, an administrator may add special accounts that are not intended for interactive use.

An account without a valid login shell can still be used for authentication unless it is locked. Locking such accounts closes that residual authentication path.

Solution

Run the following command to lock any non-root accounts without a valid login shell returned by the audit:

# usermod -L <user>

Example script:

#!/usr/bin/env bash

{
 l_valid_shells="^($(awk -F\/ '($NF != "nologin" && $NF != "false") {print}' /etc/shells | sed -rn '/^\//{s,/,\\\\/,g;p}' | paste -s -d '|' - ))$"
 while IFS= read -r l_user; do
 passwd -S "$l_user" | awk '$2 !~ /^L/ {system ("usermod -L " $1)}'
 done < <(awk -v pat="$l_valid_shells" -F: '($1 != "root" && $(NF) !~ pat) {print $1}' /etc/passwd)
}

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION

References: 800-53|AC-2(5), 800-53|AC-3, 800-53|AC-11, 800-53|IA-5, 800-53|MP-2, CSCv7|16.8

Plugin: Unix

Control ID: 105bc886d8e6573882c737911cb4c6893e02e06863e7bbe9520a2b761239e75e