7.6 Lock Inactive User Accounts - useradd -D, 35

Information

Guidelines published by the U.S. Department of Defense specify that user accounts must be
locked out after 35 days of inactivity. This number may vary based on the particular site's
policy.

Inactive accounts pose a threat to system security since the users are not logging in to
notice failed login attempts or other anomalies.

Solution

Perform the following to implement the recommended state-# useradd -D -f 35To set this policy on a user account, use the command(s)-
# usermod -f 35 [name]To set this policy on a role account, use the command(s)-# rolemod -f 35 [name]8 Warning BannersPresenting a warning message prior to the normal user login may assist the prosecution of
trespassers on the computer system. Changing some of these login banners also has the
side effect of hiding OS version information and other detailed system information from
attackers attempting to target specific exploits at a system.Guidelines published by the US Department of Defense require that warning messages
include at least the name of the organization that owns the system, the fact that the system
is subject to monitoring and that such monitoring is in compliance with local statutes, and
that use of the system implies consent to such monitoring. It is important that the
organization's legal counsel review the content of all messages before any system
modifications are made, as these warning messages are inherently site-specific. More
information (including citations of relevant case law) can be found at
http-//www.justice.gov/criminal/cybercrime/Note- The text provided in the remediation actions for these items is intended as an
example ONLY. Please edit to include the specific text for your organization as approved by
your legal department.

See Also

https://workbench.cisecurity.org/files/616

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(3), CSCv6|16.1, CSCv6|16.6

Plugin: Unix

Control ID: b3b474fc85a32f5c543c677eb5a259f511d62f5b124d8e26eeb35704bc45dba4