← Back to Oracle Linux 9 Security Technical Implementation Guide

V-271845

CAT II (Medium)

OL 9 system accounts must not have an interactive login shell.

Rule ID

SV-271845r1261748_rule

STIG

Oracle Linux 9 Security Technical Implementation Guide

Version

V1R7

CCIs

CCI-000366

Discussion

Ensuring shells are not given to system accounts upon login makes it more difficult for attackers to make use of system accounts.

Check Content

Verify that OL 9 system accounts do not have an interactive login shell.

Run the following command to list any system account (UID < 1000) that has an interactive shell, excluding authorized system utility accounts (root, sync, shutdown, halt):

$ $ awk -F: '(($3 > 0 && $3 < 1000) && $1 !~ /^(halt|sync|shutdown)$/ && $7 !~ /(nologin|false)$/) {print $1 ":" $3 ":" $7}' /etc/passwd

If the command returns any output, this is a finding.

Fix Text

Configure OL 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them.

If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO).

Run the following command to disable the interactive shell for a specific noninteractive user account:

$ sudo usermod --shell /usr/sbin/nologin <user>