Ensure the NGINX service account has an invalid shell

MediumLevel 1Automatednginx

Description

The NGINX service account must be configured with an invalid login shell to prevent interactive access. Reads the account from the user directive; its login shell must be nologin or false. Evaluated on the merged configuration printed by `nginx -T` (all included files; needs permission to read them). CIS marks this recommendation Manual; the automated check implements its audit procedure.

How it is checked

Audit method: Shell command

shell

out=$(nginx -T 2>/dev/null) || exit 1; u=$(printf '%s\n' "$out" | awk '$1=="user"{x=$2; sub(/;$/,"",x); print x; exit}'); [ -n "$u" ] || { echo noncompliant; exit 0; }; sh=$(getent passwd "$u" | cut -d: -f7) || exit 1; case "$sh" in */nologin|/bin/false|/usr/bin/false) echo compliant;; *) echo noncompliant;; esac

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

usermod -s /sbin/nologin <nginx user> (use /usr/sbin/nologin on Debian/Ubuntu).

Properties

Operating systems: Any
Tags: nginxaccounts
Reference: CIS NGINX Benchmark v3.0.0 - 2.2.3 Ensure the NGINX service account has an invalid shell

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target nginx