Ensure Interactive Login is Disabled

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Run sudo grep postgres /etc/shadow | cut -d: -f1-2. Unless the output is postgres:!<something> (locked password), interactive login is possible and this is a fail.

How it is fixed

Fix method: Guidance or infrastructure patch

Lock the account password: passwd -l postgres (and optionally set its shell to /sbin/nologin if no one uses sudo -iu postgres). Administrators then use sudo -iu postgres.