Rotate your device back to portrait to use STIG Vault.
The Red Hat Enterprise Linux 9 Security Technical Implementation Guide (V2 R9) has 445 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.
Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Rule Text
Discussion Text
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.
Verify that system accounts must not have an interactive login shell with the following command:
$ awk -F: '($3<1000){print $1 ":" $3 ":" $7}' /etc/passwd
root:0:/bin/bash
bin:1:/sbin/nologin
daemon:2:/sbin/nologin
adm:3:/sbin/nologin
lp:4:/sbin/nologin
Identify the system accounts from this listing that do not have a nologin shell.
If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO), this is a finding.
Configure RHEL 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them.
If the system account needs a shell assigned for mission operations, document the need with the information system security officer (ISSO).
Run the following command to disable the interactive shell for a specific noninteractive user account:
Replace <user> with the user that has a login shell.
$ sudo usermod --shell /sbin/nologin <user>
Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.