When trying to harden a unit with mysql-router subordinate charm, the audit fails on rule `xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts`: "Ensure that System Accounts Do Not Run a Shell Upon Login"
Indeed, the mysql user account has a /bin/sh shell associated. It should be /sbin/nologin for security standards.
When trying to harden a unit with mysql-router subordinate charm, the audit fails on rule `xccdf_ org.ssgproject. content_ rule_no_ shelllogin_ for_systemaccou nts`: "Ensure that System Accounts Do Not Run a Shell Upon Login"
Indeed, the mysql user account has a /bin/sh shell associated. It should be /sbin/nologin for security standards.
Attached initial usg report.
- Version: 8.0.36
- Revision: 154
CIS hardening suggests the following script to check with user accounts need to be fixed: shells= "^($(awk -F\/ '$NF != "nologin" {print}' /etc/shells | sed -rn '/^\//{ s,/,\\\ \/,g;p} ' | paste -s -d '|' - ))$" valid_shells" -F: '($1!~/ ^(root| halt|sync| shutdown| nfsnobody) $/ && ($3<'"$(awk '/^\s*UID_ MIN/{print $2}' /etc/login.defs)"' || $3 == 65534) && $(NF) ~ pat) {print "Service account: \"" $1 "\" has a valid shell: " $7}' /etc/passwd
```
#!/usr/bin/env bash
{
l_valid_
awk -v pat="$l_
}
```
Output is:
```
Service account: "mysql" has a valid shell: /bin/sh
```
Do we have a good reason to keep /bin/sh for mysql account that will maybe justify the rationale that breaks this rule ?