Rule ID
SV-44654r1_rule
Version
V1R12
If special privilege accounts are compromised, the accounts could provide privileges to execute malicious commands on a system.
Perform the following to check for unnecessary privileged accounts: # grep "^shutdown" /etc/passwd # grep "^halt" /etc/passwd # grep "^reboot" /etc/passwd If any unnecessary privileged accounts exist this is a finding.
Remove any special privilege accounts, such as shutdown and halt, from the /etc/passwd and /etc/shadow files using the "userdel" or "system-config-users" commands.