4502-nginx-serverlocked - Ensure NGINX Service Account Is Locked¶

Rule ID¶

• 4502-nginx-serverlocked

Category¶

• nginx

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The nginx user account should have a valid password, but the account should be locked.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• As a defense-in-depth measure, the nginx user account should be locked to prevent login and to prevent someone from using a password to switch users to nginx. In general, no one should need to su as nginx; when necessary, sudo should be used instead, which does not require the nginx account password.

Risk¶

• nginx security

Audit Method¶

• Execute the following command to verify that the file and group are owned by nginx:

passwd -S nginx
## The output should resemble one of the following:
# nginx LK 2010-01-28 0 99999 7 -1 (Password locked.)
# or
# nginx L 07/02/2012 -1 -1 -1 -1

Remediation¶

• Execute the following command to lock the user:

#> passwd -l nginx

Impact¶

• This ensures that the nginx user account cannot be used by human users.

Default Value¶

• By default, the nginx user is locked.

References¶

• nginx-user

CIS Controls¶

• None