Default system accounts must be disabled or removed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-810	GEN002640	SV-37903r1_rule	IAAC-1	Medium

Description
Vendor accounts and software may contain backdoors allowing unauthorized access to the system. These backdoors are common knowledge and present a threat to system security if the account is not disabled.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2017-03-01

Details

Check Text ( C-37129r2_chk )
Determine if default system accounts (such as those for sys, bin, uucp, nuucp, daemon, smtp) have been disabled. # cat /etc/shadow If an account's password field (which is the second field in the /etc/shadow file) is "*", "*LK*", or is prefixed with a '!', the account is locked or disabled. If there are any unlocked default system accounts this is a finding.

Fix Text (F-32397r1_fix)
Lock the default system account(s). # passwd -l