Ensure system accounts are secured

How it is checked

Audit method: Shell command

min=$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs); min=${min:-1000}; shells=$(awk -F/ '/^\// && $NF != "nologin"' /etc/shells); bad=0; while IFS=: read -r u p uid g c h sh; do for x in root sync shutdown halt; do [ "$u" = "$x" ] && continue 2; done; case $u in +*) continue;; esac; [ "$uid" -lt "$min" ] 2>/dev/null || continue; printf "%s\n" "$shells" | grep -qxF -- "$sh" && bad=1; done < /etc/passwd; [ $bad -eq 0 ] && echo compliant || echo noncompliant

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the commands appropriate for your distribution: Set the shell for any accounts returned by the audit to nologin: # usermod -s $(which nologin) <user> Lock any non root accounts returned by the audit: # usermod -L <user> The following command will set all system accounts to a non login shell: awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' && $7!="'"$(which nologin)"'" && $7!="/bin/false") {print $1}' /etc/passwd | while read user; do usermod -s $(which nologin) $user; done The following command will automatically lock not root system accounts: awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | awk '($2!="L" && $2!="LK") {print $1}' | while read user; do usermod -L $user; done

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target cos --level 2