| name | cis-ubuntu2004-v300-5-4-2-7 |
| description | Ensure system accounts do not have a valid login shell |
| category | cis-iam |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","users","authentication"] |
| cis_id | 5.4.2.7 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.4.2.7 Ensure system accounts do not have a valid login shell (Automated)
Profile
- Level 1 - Server
- Level 1 - Workstation
Description
There are a number of accounts provided with most distributions that are used to manage applications and are not intended to provide an interactive shell. Furthermore, a user may add special accounts that are not intended to provide an interactive shell.
Rationale
It is important to make sure that accounts that are not being used by regular users are prevented from being used to provide an interactive shell. By default, most distributions set the password field for these accounts to an invalid string, but it is also recommended that the shell field in the password file be set to the nologin shell. This prevents the account from potentially being used to run any commands.
Audit Procedure
Command Line
Run the following command to verify system accounts, except for root, halt, sync, shutdown or nfsnobody, do not have a valid login shell:
#!/usr/bin/env bash
{
l_valid_shells="^($(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//!d;s,/,\\\\/,g;p' | paste -s -d '|' - ))$"
awk -v pat="$l_valid_shells" -F: '($1!~/^(root|halt|sync|shutdown|nfsnobody)$/ && ($3<'"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' || $3 == 65534) && $(NF) ~ pat) {print "Service account: \"" $1 "\" has a valid shell: " $7}' /etc/passwd
}
Expected Result
Nothing should be returned
Remediation
Command Line
Run the following command to set the shell for any service accounts returned by the audit to nologin:
Example script:
#!/usr/bin/env bash
{
l_valid_shells="^($(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//!d;s,/,\\\\/,g;p' | paste -s -d '|' - ))$"
awk -v pat= -F: /etc/passwd
}
