cyberstrikeus CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 4.5.6
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Description
/etc/shells is a text file which contains the full pathnames of valid login shells. This file is consulted by chsh and available to be queried by other programs.
Be aware that there are programs which consult this file to find out if a user is a normal user; for example, FTP daemons traditionally disallow access to users with shells not included in this file.
Rationale
A user can use chsh to change their configured shell.
If a user has a shell configured that isn't in in /etc/shells, then the system assumes that they're somehow restricted. In the case of chsh it means that the user cannot change that value.
Other programs might query that list and apply similar restrictions.
By putting nologin in /etc/shells, any user that has nologin as its shell is considered a full, unrestricted user. This is not the expected behavior for nologin.
Audit Procedure
Command Line
Run the following command to verify that nologin is not listed in the /etc/shells file:
grep '/nologin\b' /etc/shells
Expected Result
Nothing should be returned.
Remediation
Command Line
Edit /etc/shells and remove any lines that include nologin.
References
- shells(5)
- NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5
CIS Controls
v8 - 3.3 Configure Data Access Control Lists - Configure data access control lists based on a user's need to know.
v7 - 14.6 Protect Information through Access Control Lists.
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Assessment Status
Automated