4503-nginx-nologin-Ensure the NGINX service account's shell is invalid¶

Rule ID¶

• 4503-nginx-nologin

Category¶

• nginx

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The nginx account should not be allowed to log in, so its shell should be set to /sbin/nologin.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The account used for nginx should be dedicated solely to the nginx service and does not require login capability. This prevents attackers from using the account to log in.

Risk Items¶

• nginx security

Audit Method¶

• Execute the following command to verify:

grep nginx /etc/passwd

Remediation¶

• Execute the following command:

#> chsh -s /sbin/nologin nginx

Impact¶

• This ensures that the nginx user account cannot be used by human users.

Default Value¶

• By default, the shell for the nginx user is /sbin/nologin.

References¶

• nginx-user

CIS Controls¶

• None