documentation_complete: true

title: 'Ensure that System Accounts Are Locked'

description: |-
    Some accounts are not associated with a human user of the system, and exist to
    perform some administrative function. An attacker should not be able to log into
    these accounts.
    <br /><br />
    System accounts are those user accounts with a user ID
    less than UID_MIN, where value of the UID_MIN directive is set in
    <tt>/etc/login.defs</tt> configuration file. In the default configuration UID_MIN is set
    to 500, thus system accounts are those user accounts with a user ID less than
    500. If any system account <i>SYSACCT</i> (other than root) has an unlocked password,
    disable it with the command:
    <pre>$ sudo passwd -l <i>SYSACCT</i></pre>

rationale: |-
    Disabling authentication for default system accounts makes it more difficult
    for attackers to make use of them to compromise a system.false

severity: medium

identifiers:
    cce: 80510-1

references:
    disa: 366
    nist: ""
    srg: SRG-OS-999999
    stigid: RHEL-06-000029

ocil_clause: 'it is not'

ocil: |-
    To obtain a listing of all users and the contents of their shadow password
    field, run the command:
    <pre>$ sudo awk -F: '$1 !~ /^root$/ &amp;&amp; $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow</pre>
    Identify the system accounts from this listing. These will primarily be the accounts
    with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
    directive is set in <tt>/etc/login.defs</tt> configuration file. In the default
    configuration, UID_MIN is set to 500.
