STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

OL 9 system accounts must not have an interactive login shell.

DISA Rule

SV-271845r1092247_rule

Vulnerability Number

V-271845

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

OL09-00-003051

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure OL 9 so that all noninteractive accounts on the system do not have an interactive shell assigned to them.

If the system account needs a shell assigned for mission operations, document the need with the ISSO.

Run the following command to disable the interactive shell for a specific noninteractive user account:

Replace <user> with the user that has a login shell.

$ sudo usermod --shell /sbin/nologin <user>

Do not perform the steps in this section on the root account. Doing so will cause the system to become inaccessible.

Check Contents

Verify that OL 9 configures system accounts to not have an interactive login shell with the following command:

$ awk -F: '($3<1000){print $1 ":" $3 ":" $7}' /etc/passwd
root:0:/bin/bash
bin:1:/sbin/nologin
daemon:2:/sbin/nologin
adm:3:/sbin/nologin
lp:4:/sbin/nologin

Identify the system accounts from this listing that do not have a nologin shell.

If any system account (other than the root account) has a login shell and it is not documented with the information system security officer (ISSO), this is a finding.

Vulnerability Number

V-271845

Documentable

False

Rule Version

OL09-00-003051

Severity Override Guidance

Check Content Reference

Target Key

5680