Title

Default system accounts must be disabled or removed. (Cat II impact)

Discussion

Vendor accounts and software may contain backdoors allowing unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.

Check Content

Determine if default system accounts (such as those for guest, sys, bin, uucp, nuucp, daemon, smtp, and lpd) have been disabled. Procedure: # lsuser -a account_locked ALL If there are any unlocked default system accounts, this is a finding.

Fix Text

Lock the default system account(s). # chuser account_locked=true <user>

Additional Identifiers

Rule ID: SV-38897r1_rule

Vulnerability ID: V-810

Group Title: GEN002640

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.