4504-nginx-ownership-/etc/nginx directory and its files should be owned by root¶

Rule ID¶

• 4504-nginx-ownership

Category¶

• nginx

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The nginx account should not be able to log in, so /sbin/nologin should be set for this account.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• The account used for nginx should only be used for the nginx service and should not have login capability. This prevents attackers from using the account to log in.

Risk Item¶

• nginx security

Audit Method¶

• Run the following command to verify:

grep nginx /etc/passwd

Remediation¶

• Execute the following command:

  #> chsh -s /sbin/nologin nginx
  

Impact¶

• This ensures that the nginx user account cannot be used by human users.

Default Value¶

• By default, the nginx user's shell is /sbin/nologin.

References¶

• nginx-user

CIS Controls¶

• None