# Ensure accounts without a valid login shell are locked

Necessity: System or service accounts (e.g., 'apache', 'nobody') are assigned a non-interactive shell like '/sbin/nologin' to prevent direct logins. However, if these accounts are not explicitly locked, they might still possess a valid (though perhaps unknown) password hash. This could potentially be exploited by services that authenticate users without initiating a shell, or by attackers who find a way to bypass shell restrictions. Locking the account by prepending '!' or '!!' to the password hash in '/etc/shadow' provides a critical defense-in-depth layer, ensuring the account cannot be used for any form of password-based authentication.

Auditing and Remediation: The audit script scans system accounts, cross-referencing the shell specified in '/etc/passwd' with the account's lock status derived from '/etc/shadow' (or via 'passwd -S'). It reports any accounts with a non-interactive shell that are not in a locked state. The remediation script directly addresses this by executing 'passwd -l <username>', which modifies the shadow password file to disable the account's password.

Recommended State Rationale: The recommended state is consistently 'Locked' for all levels (Basic, Moderate, Strict) because this is a fundamental, non-negotiable security control. There is no acceptable scenario where a non-interactive system account should remain unlocked. This principle is a standard requirement in security hardening guidelines, including CIS Benchmarks, as it directly mitigates the risk of account misuse.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Locked']` |
| **Moderate** | `['Locked']` |
| **Strict** | `['Locked']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies and returns a space-separated list of local user accounts that have their shell set to '/sbin/nologin' or '/bin/false' but are not locked. The script should only output the list of usernames. If no such accounts exist, the script should output nothing.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the username of an account to be locked. The script must use the 'passwd -l' command to lock the specified user's account. The script must return 'true' upon successful execution and 'false' if the command fails.

