V-261358

Discussion

Accounts providing no operational purpose provide additional opportunities for system compromise. Therefore all necessary noninteractive accounts should not have an interactive shell assigned to them.

Check Content

Verify all noninteractive SLEM 5 accounts do not have an interactive shell assigned to them with the following command:

Check the system accounts on the system.

     > awk -F: '($7 !~ "/sbin/nologin" && $7 !~ "/bin/false"){print $1 ":" $3 ":" $7}' /etc/passwd
     root:0:/bin/bash
     nobody:65534:/bin/bash

Obtain the list of authorized system accounts from the information system security officer (ISSO).

If noninteractive accounts such as "games" or "nobody" are listed with an interactive shell, this is a finding.