V-285669

Discussion

System service accounts are intended to support operating system and platform services and should not be used for interactive user access. If service accounts are configured with interactive shells or unnecessary group memberships, they may provide an unauthorized path for logon, privilege escalation, or misuse of service-level permissions. Restricting service accounts to noninteractive shells and required service groups limits the ability of users or processes to misuse privileged service identities. The operating system must ensure service accounts are present only as required for system operation and are configured to prevent interactive access.

Check Content

Verify the etcd service account and group are configured for noninteractive service use.

1. Access the operating system using a privileged account. Verify the etcd group exists:

getent group etcd

If the etcd group does not exist, this is a finding.

2. Verify the etcd user exists:

getent passwd etcd

If the etcd user does not exist, this is a finding.

3. Verify the etcd user has a noninteractive shell:

getent passwd etcd | cut -d: -f7

The output must be "/sbin/nologin".

If the etcd account has an interactive shell, such as "/bin/bash", "/bin/sh", or any shell other than the approved noninteractive shell, this is a finding.

4. Verify the etcd user is a member of the etcd group "id -nG etcd".

If the output does not include etcd, this is a finding.