V-288824

Discussion

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

Check Content

Verify OL 8 system accounts do not have an interactive login shell.

Run the following command to list any system account (UID < 1000) that has an interactive shell, excluding authorized system utility accounts (root, sync, shutdown, halt):

$ awk -F: '(($3 > 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' /etc/passwd

If the command returns any output, this is a finding.

If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO), this is a finding.