Check Details

• Resource: Server
• Check: Ensure System Accounts are Secured
• Risk: If system accounts are allowed to use interactive shells or remain unlocked, attackers may exploit them to run commands or gain unauthorized access to the server.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Set the shell for any system accounts to a non-login shell to prevent interactive login.

   

   sudo usermod -s $(which nologin) <user>
   

3. Lock any non-root system accounts that should not be used for login.

   

   sudo usermod -L <user>
   

4. To automatically set all system accounts to a non-login shell, run the following command.

   

   awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" &&
   $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' &&
   $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' &&
   $7!="'"$(which nologin)"'" && $7!="/bin/false") {print $1}' /etc/passwd |
   while read user; do usermod -s $(which nologin) $user; done
   

5. Automatically lock all non-root system accounts that should not be used for login.

   

   awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' &&
   $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"') {print $1}' /etc/passwd |
   xargs -I '{}' passwd -S '{}' |
   awk '($2!="L" && $2!="LK") {print $1}' |
   while read user; do usermod -L $user; done
   

6. Verify that all system accounts use a non-login shell and are properly locked if not required.

Note: The root, sync, shutdown, and halt accounts are exempt from this requirement and may retain their default configuration.