Ensure nologin is not listed in /etc/shells

LowLevel 2Automatedlinux

Description

/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs. Be aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.

How it is checked

Audit method: Shell command

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Ps '"'"'^\h*([^#\n\r]+)?\/nologin\b'"'"' /etc/shells' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Edit /etc/shells and remove any lines that include nologin

Properties

Operating systems: rocky-9
Tags: cis-convertedlinux
Reference: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.4.3.1

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux --level 2