Description

Accounts meant for non-interactive purposes should be locked to prevent unauthorized access. Accounts with non-standard shells (those not defined in /etc/shells) should be locked using usermod -L.

Rationale

Locking non-interactive accounts improves security by preventing potential misuse. While many systems configure these accounts with invalid strings, setting the shell field to nologin is also suggested

Warning

Automatic remediation of this control is not recommended. Locking system accounts could be highly disruptive.