# Ensure system accounts do not have a valid login shell

Necessity: System accounts are used by services and applications, not humans, and should not have interactive login capabilities. Assigning a valid login shell to a system account creates a significant security risk. If an attacker compromises a service running as one of these accounts, they could gain an interactive shell, providing a foothold to perform reconnaissance, escalate privileges, and launch further attacks on the system. Ensuring system accounts have a non-login shell is a critical hardening measure that limits an attacker's capabilities post-exploitation. Auditing and Remediation: The audit script identifies system accounts by checking their UID (1-999) in /etc/passwd and cross-referencing their assigned shell with the list of valid login shells in /etc/shells. The remediation script uses a standard utility like 'usermod' to change a specified user's shell to a non-interactive one, thereby revoking its ability to be used for login. Recommended State Rationale: Basic: ['/bin/false'] sets the shell to a program that immediately exits with a failure status, effectively and silently blocking login attempts. Moderate: ['/usr/sbin/nologin'] is the preferred standard. It also prevents login but displays a polite message ('This account is currently not available.'), which is more informative for administrators and makes the intended configuration explicit. Strict: ['/usr/sbin/nologin'] is also the strict recommendation as it is the most robust and commonly accepted method for disabling system account logins, achieving the security goal with added clarity over '/bin/false'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/bin/false']` |
| **Moderate** | `['/usr/sbin/nologin']` |
| **Strict** | `['/usr/sbin/nologin']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that parses the /etc/passwd file to identify all system accounts (UID between 1 and 999) that are assigned a valid login shell as defined in /etc/shells. The script must output a space-separated string of the usernames of any non-compliant accounts. If no accounts are non-compliant, it should output an empty string.

## Remediation Script Working

Bash script that takes a single positional argument: the username of a system account. The script must change the user's shell to '/usr/sbin/nologin'. The script must output 'true' if the change is successful and 'false' if it fails (e.g., the user does not exist or the command fails).

