V-256511

Discussion

Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Disabling inactive accounts ensures accounts that may not have been responsibly removed are not available to attackers who may have compromised their credentials.

Check Content

At the command line, run the following command:

# grep INACTIVE /etc/default/useradd

Expected result:

INACTIVE=0

If the output does not match the expected result, this is a finding.