# Ensure system accounts do not have a valid login shell

Necessity: System accounts are created for services and applications to run under, not for interactive user logins. Assigning a valid login shell to a system account violates the principle of least privilege. If a service running under such an account is compromised, an attacker could gain an interactive shell, providing a direct foothold to explore the system, escalate privileges, and move laterally across the network. Disabling login shells for these accounts is a critical security measure to reduce the attack surface.

Auditing and Remediation: The audit script systematically checks all system accounts (typically those with UIDs below 1000, excluding root) by comparing their assigned shell in '/etc/passwd' against the list of valid login shells in '/etc/shells'. It flags any account that is improperly configured. The remediation script corrects this misconfiguration by using the 'usermod' utility to change the specified account's shell to a non-interactive one.

Recommended State Rationale:
- Basic: Recommends '/sbin/nologin'. This is the standard, most common non-interactive shell used for this purpose. When a login is attempted, it typically displays a polite message indicating that the account is not available and then terminates the session, which is good for administrative clarity.
- Moderate: Includes '/bin/false' as an alternative. Functionally, it is just as secure as '/sbin/nologin' in preventing logins. The primary difference is that it immediately exits with a failure status code without printing any message. Some security standards consider this slightly better as it provides less information to a potential attacker.
- Strict: The strict recommendation remains the same as moderate because both '/sbin/nologin' and '/bin/false' are considered best-practice, fully secure options. The stringency at this level comes from ensuring this policy is applied universally to every non-essential system account without exception.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['/sbin/nologin']` |
| **Moderate** | `['/sbin/nologin', '/bin/false']` |
| **Strict** | `['/sbin/nologin', '/bin/false']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies all system accounts (UIDs between 1 and 999, inclusive) that are assigned a valid login shell from /etc/shells. The script must output only the usernames of these non-compliant accounts, each on a new line, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which is the username of a system account. The script must change the shell for this user to '/sbin/nologin'. The script must return the string 'true' on success and 'false' on failure.

