Description
Every local account must belong to a current person or service. Accounts of people who left or changed role, and of services that were removed, must be locked or deleted.
Rationale
Unused accounts are attractive to attackers: their owner will not notice a login, and their password or SSH key may have leaked long ago.
Impact
Requires a periodic review with the people who know who still needs access.
Audit
- List the interactive accounts:
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd. - For each, check with its owner or manager that it is still needed.
lastlogandlastshow the last logins. - List the service accounts and check that the matching service is still installed.
Remediation
Lock unused accounts with usermod -L -e 1 <account> (also expires SSH key logins), and
delete them with userdel -r <account> once their files have been archived.
References
- usermod(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R30) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation |
|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R30 | equivalent |
| NIST SP 800-53 Rev. 55.1.1 | AC-2(3) | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1078.003 |
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
