Practical UNIX and Internet Security, 3rd Edition

Chapter 19: Defending Accounts

• Make sure that every account has a password.

• Make sure to change the password of every “default” account that came with your Unix system. If possible, disable accounts such as uucp and daemon so that people cannot use them to log into your system.

• Do not set up accounts that run single commands.

• Instead of logging into the root account, log into your own account and use su or sudo.

• Do not create “default” or “guest” accounts for visitors.

• If you need to set up an account that can run only a few commands, use the rsh restricted shell.

• Think about creating restricted filesystem accounts for special-purpose commands or users.

• Do not set up a single account that is shared by a group of people. Use the group ID mechanism instead.

• Monitor the format and contents of the /etc/passwd file.

• Put time/tty restrictions on account logins as appropriate.

• Disable dormant accounts on your computer.

• Disable the accounts of people on extended vacations.

• Establish a system by which accounts are always created with a fixed expiration date and must be renewed to be kept active.

• Do not declare network connections, modems, or public terminals as “secure” in the /etc/default/login or /etc/ttys files.

• Be careful who you put in the wheel group, as these people can use the su command to become the superuser (if applicable).

• If possible, set your systems to require the root password when rebooting in single-user mode.

• If your system supports the TCB/trusted path mechanism, enable it.

• If your ...