Cis Nginx V300 2 2 2

CIS 2.2.2 — Ensure the NGINX service account is locked

Profile Applicability

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer

Description

The NGINX service account must not have a usable password and should be explicitly locked in the system's shadow file to prevent direct login or password-based privilege escalation.

Rationale

As a defense-in-depth measure, the NGINX service account should be explicitly locked. This prevents password-based logins and blocks adversaries from using the account for lateral movement, even if they manage to change the account's shell configuration.

In a properly hardened environment, there is no operational need for any user to log in as nginx. Administrative tasks requiring the NGINX identity should be performed using sudo (e.g., sudo -u nginx), which utilizes the administrator's credentials rather than the service account's password.

Impact

Locking the service account has minimal operational impact. The account is not intended for human interaction, and all administrative tasks requiring the NGINX user context should already be performed using sudo -u nginx rather than password-based authentication.

Audit Procedure

1. Identify the User:

nginx -T 2>/dev/null | grep -i "^user"

(Note the user, e.g., nginx)

2. Check Lock Status:

Run the following command for the identified user:

passwd -S nginx

Evaluation:

Verify that the output indicates a locked status:

• RHEL: Shows LK or Password locked.
• Debian/Ubuntu: Shows L.

Remediation

Lock the account using the passwd command:

passwd -l nginx

(Replace nginx with the actual service user found in step 1)

Default Value

System users created by official packages are typically created without a password (locked by default).

References

1. https://nginx.org/en/docs/ngx_core_module.html#user

CIS Controls

MITRE ATT&CK Mappings

Profile

• Level 1 - Webserver
• Level 1 - Proxy
• Level 1 - Loadbalancer