cis-ubuntu1804-v220-4-5-2

name	cis-ubuntu1804-v220-4-5-2
description	Ensure system accounts are secured
category	cis-iam
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","users","account-security"]
cis_id	4.5.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.5.2

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell.

Rationale

It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the nologin shell. This prevents the account from potentially being used to run any commands.

Audit Procedure

Command Line

Run the following script to verify all local system accounts:

• Do not have a valid login shell
• Are locked

#!/usr/bin/env bash
{
  l_output="" l_output2=""
  l_valid_shells="$($(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{s,/,\\/,g;p}' | paste -s -d '|' - )$"
  a_users=(); a_ulock=()
  while read -r l_user; do
    a_users+=("$l_user")
  done < <(awk -v pat="$l_valid_shells" -F: '($1!~/^(root|sync|shutdown|halt)^\+/) && $3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' && $(NF) ~ pat { print $1 }' /etc/passwd)
  while read -r l_ulock; do
    a_ulock+=("$l_ulock")
  done < <(awk -v pat="$l_valid_shells" -F: '($1!~/^(root)^\+/) && $2!~/LK?/ && $3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)" /etc/passwd)
   ! ((  >  )); 
    l_output=
  
    l_output2=
  
   ! ((  >  )); 
    l_output=
  
    l_output2=
  
   [ -z  ]; 
     -e 
  
     -e 
    [ -n  ] &&  -e 
  
}