# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-AUTH-018
title: Prevent interactive logins to system accounts
finding:
  title: A system account has a login shell or an unlocked password
  description: Service accounts are rarely watched; one that accepts logins is an easy way in or a quiet persistence point.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [accounts, service-accounts]

description: |
  System accounts (UID below `UID_MIN`, 1000 on Debian) run services and own files. They do not
  need to log in. Their shell must be `/usr/sbin/nologin` or `/bin/false`, and their password
  must be locked. `root`, `sync`, `shutdown` and `halt` are the exceptions.
rationale: |
  A system account with a valid shell can be used to log in if it ever gets a password or an
  SSH key, and attackers like to add access to such accounts because nobody checks them.
impact: |
  Services keep working: they do not use a login shell. Administrators who need a shell as a
  service account use `sudo -u <account> -s /bin/bash`.
notes: |
  Accounts are read from `/etc/passwd` only; network directories (LDAP, SSSD) are out of scope.

audit:
  manual: |
    1. `awk -F: '$3 < 1000 && $1 !~ /^(root|sync|shutdown|halt)$/ {print $1, $7}' /etc/passwd`:
       every shell must be `/usr/sbin/nologin`, `/sbin/nologin` or `/bin/false`.
    2. Every account with such a non-login shell must show `L` with `passwd -S`.
  checks:
    - id: shells
      engine: shell
      description: System accounts with a login shell.
      spec:
        script: |
          bad=$(awk -F: '$3 < 1000 && $1 !~ /^(root|sync|shutdown|halt)$/ && $7 !~ /^(\/usr)?\/sbin\/nologin$|^\/bin\/false$/ {print $1 ":" $7}' /etc/passwd)
          echo "${bad:-none}"
          [ -z "$bad" ]
    - id: locked
      engine: shell
      description: Accounts without a login shell that are not locked.
      spec:
        script: |
          bad=
          for u in $(awk -F: '$1 != "root" && $7 ~ /nologin$|^\/bin\/false$/ {print $1}' /etc/passwd); do
            s=$(passwd -S "$u" 2>/dev/null | cut -d' ' -f2)
            [ "$s" = L ] || bad="$bad $u:$s"
          done
          echo "${bad:-none}"
          [ -z "$bad" ]

remediation:
  manual: |
    1. For each listed system account: `usermod -s /usr/sbin/nologin <account>`.
    2. For each account without a login shell that is not locked: `usermod -L <account>`.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Restore `/etc/passwd` and `/etc/shadow` from the backup.
  scripts:
    - id: fix
      engine: shell
      content: |
        cb_backup /etc/passwd
        cb_backup /etc/shadow
        awk -F: '$3 < 1000 && $1 !~ /^(root|sync|shutdown|halt)$/ && $7 !~ /^(\/usr)?\/sbin\/nologin$|^\/bin\/false$/ {print $1}' /etc/passwd |
          while read -r u; do usermod -s /usr/sbin/nologin "$u"; done
        for u in $(awk -F: '$1 != "root" && $7 ~ /nologin$|^\/bin\/false$/ {print $1}' /etc/passwd); do
          [ "$(passwd -S "$u" | cut -d' ' -f2)" = L ] || usermod -L "$u"
        done

references:
  - title: usermod(8), Debian manual pages
    url: https://manpages.debian.org/trixie/passwd/usermod.8.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R34)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R34
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.7"
    relation: equivalent
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.8"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.7"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.8"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1078.003

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18