9.3 Verify System Account Default Passwords - locked

Information

There are a number of accounts provided with the Solaris OS that are used to manage
applications and are not intended to provide an interactive shell. These accounts are
delivered either in a locked or non-login state. Oracle does not support nor recommend
changing the passwords associated with these accounts.

System accounts, such as bin, lpd, and sys have special purposes and privileges. By
default, these accounts are configured as either locked or non-login. This status should be
verified to ensure that these accounts have not accidentially or intentionally been enabled.

Solution

To lock a single account, use the command-
# passwd -d [username]
# passwd -l [username]To configure a single account to be non-login, use the command-# passwd -d [username]
# passwd -N [username]

See Also

https://workbench.cisecurity.org/files/616

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2f.

Plugin: Unix

Control ID: 9a6f5074efa91ecb6c8d25cdf48ff49397ae94773473d6880c0c4ebf0cf079e7