# Ensure accounts without a valid login shell are locked

Necessity: System and service accounts (e.g., daemon, bin, sys) are not intended for interactive login. Assigning them a non-login shell (like /usr/sbin/nologin) is the first step in preventing their misuse. However, locking the account provides a critical second layer of defense. It ensures that even if a vulnerability allows an attacker to attempt authentication as that user, the account is disabled at the password level, preventing login. This mitigates the risk of an attacker gaining an interactive shell on the system after compromising a service. Auditing and Remediation: The audit script cross-references /etc/passwd and /etc/shells to find accounts with invalid login shells, and then checks their lock status in /etc/shadow. The remediation script uses the 'passwd -l' command to apply a lock to any of these accounts that are found to be unlocked. Recommended State Rationale: The recommendation for all levels (Basic, Moderate, Strict) is 'Enforced'. This is a foundational, binary security control. An account that should not be used for login must be locked; there is no acceptable less-secure state. This configuration aligns with the principle of least privilege and is a standard recommendation in security benchmarks like CIS. Allowing such accounts to remain unlocked presents an unnecessary and significant security risk, regardless of the overall hardening level of the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enforced']` |
| **Moderate** | `['Enforced']` |
| **Strict** | `['Enforced']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies all local user accounts configured with a shell not listed in /etc/shells. For each of these accounts, the script must check if it is locked (i.e., the password hash in /etc/shadow begins with '!' or '*'). The script must return a single, space-separated string of any such accounts found to be unlocked. If all such accounts are locked, the script must return an empty string.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be the string 'enforce'. The script will identify all local user accounts whose login shell is not listed in /etc/shells. It will then iterate through these accounts and use the 'passwd -l <username>' command to lock any account that is not already locked. The script must return 'true' if all identified accounts were successfully locked or were already locked, and 'false' if any locking operation fails.

