Servers – Ensure System Accounts Are Secured

Support > Fixing Checks > Server

06 March, 2026

This check ensures that system accounts are secured and cannot be used for interactive login.

System accounts are typically used by applications and services. These accounts should not have login shells or active passwords, as they can be exploited to gain unauthorized access to the system.

Check Details

Resource: Server
Check: Ensure system accounts are secured
Risk: System accounts with login access can be exploited to execute commands or gain unauthorized access.

Remediation Steps

Open a terminal session on the server with root or sudo privileges.

Run the following command to identify system accounts with valid login shells:

awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && 
$1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && 
$3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' && 
$7!="'"$(which nologin)"'" && $7!="/bin/false") {print}' /etc/passwd

Run the following command to check for unlocked system accounts:

awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print 
$2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' 
/etc/login.defs)"') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | 
awk '($2!="L" && $2!="LK") {print $1}'

Set the shell for identified accounts to nologin:
```
sudo usermod -s $(which nologin) <user>
```
Lock any non-root system accounts:
```
sudo usermod -L <user>
```

To automatically set all system accounts to a non-login shell, run:

awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && 
$1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && 
$3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' && 
$7!="'"$(which nologin)"'" && $7!="/bin/false") {print $1}' /etc/passwd | 
while read user; do usermod -s $(which nologin) $user; done

To automatically lock all non-root system accounts, run:

awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print 
$2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' 
/etc/login.defs)"') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | 
awk '($2!="L" && $2!="LK") {print $1}' | while read user; do usermod -L $user; done

Verify that no system accounts have interactive login access after applying the changes.

Other Articles

Servers – Ensure System Accounts Are Secured

Check Details

Remediation Steps