Title

Default system accounts must be disabled or removed. (Cat II impact)

Discussion

Vendor accounts and software may contain backdoors allowing unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.

Check Content

Determine if default system accounts (such as, those for sys, bin, uucp, nuucp, daemon, smtp, gdm, lp, nobody) have been disabled. # cat /etc/shadow If an account's password field is "*", "*LK*", "NP", or is prefixed with a "!", the account is locked or disabled. If any default system account is not locked and its use is not justified and documented with the ISSO, this is a finding.

Fix Text

Lock the default system account(s). # passwd -l <user>

Additional Identifiers

Rule ID:

Vulnerability ID: V-810

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.