Default system accounts must be disabled or removed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-810	GEN002640	SV-27264r2_rule	IAAC-1	Medium

Description
Vendor accounts and software may contain backdoors that will allow unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.

STIG	Date
HP-UX SMSE Security Technical Implementation Guide	2014-02-28

Details

Check Text ( C-36408r2_chk )
Account/password locking is typically accomplished with the asterisk (). System logins that never had a password use a double exclamation mark (!!) and accounts that have been locked have the valid password entry invalidated by a single exclamation mark (!) prefix. For Trusted Mode: Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Next check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled. # grep “u_pwd=“ /tcb/files/auth/[a-z,A-Z]/ If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding. For SMSE: Check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled. # cat /etc/shadow If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding.

Check Text ( C-36408r2_chk )

Account/password locking is typically accomplished with the asterisk (*). System logins that never had a password use a double exclamation mark (!!) and accounts that have been locked have the valid password entry invalidated by a single exclamation mark (!) prefix.

For Trusted Mode:
Protected password database files are maintained in the /tcb/files/auth hierarchy. This directory contains other directories each named with a single letter from the alphabet. User authentication profiles are stored in these directories based on the first letter of the user account name. Next check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled.
# grep “u_pwd=“ /tcb/files/auth/[a-z,A-Z]/*

If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding.

For SMSE:
Check if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled.
# cat /etc/shadow

If any default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have not been disabled, this is a finding.

Fix Text (F-31746r2_fix)
For Trusted Mode and SMSE: Use the System Administration Manager (SAM) or the System Management Homepage (SMH) to lock/disable or remove any enabled default system accounts.