5.5.2 Ensure system accounts are secured - unlocked non-root

Information

There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell.

Rationale:

It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the nologin shell. This prevents the account from potentially being used to run any commands.

Note: The root, sync, shutdown, and halt users are exempted from requiring a non-login shell.

Solution

Run the commands appropriate for your distribution:
Set the shell for any accounts returned by the audit to nologin:

# usermod -s $(which nologin) <user>

Lock any non root accounts returned by the audit:

# usermod -L <user>

The following command will set all system accounts to a non login shell:

awk -F: '($1!='root' && $1!='sync' && $1!='shutdown' && $1!='halt' && $1!~/^+/ && $3<''$(awk '/^s*UID_MIN/{print $2}' /etc/login.defs)'' && $7!='''$(which nologin)''' && $7!='/bin/false' && $7!='/usr/bin/false') {print $1}' /etc/passwd | while read -r user; do usermod -s '$(which nologin)' '$user'; done

The following command will automatically lock not root system accounts:

awk -F: '($1!='root' && $1!~/^+/ && $3<''$(awk '/^s*UID_MIN/{print $2}' /etc/login.defs)'') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | awk '($2!='L' && $2!='LK') {print $1}' | while read -r user; do usermod -L '$user'; done

See Also

https://workbench.cisecurity.org/files/3636