security policies for system accounts adm, lp, bin etc

[Dave Chamberlin]

I have recently converted my HPUX 11.0 system to trusted. Several system accounts - adm, sys, bin, lp and others are now deactivated. When I try to reactivate - SAM indicates that they have a password of "*", which is why they are deactivated. Do I have to manage passwords for these accounts? Does it matter if they are deactivated? What is a typical was to manage this type of account (from a security perspective)? thanks

[Jeff_Traigle · Accepted solution]

Those are always locked even on an unTrusted System (or should be anyway). There's no reason to put passwords on them. Some of the don't even have login shells defined. Leave them as is and don't worry about them.

[Sridhar Bhaskarla]

Dave,

I would worry about setting up passwords or activating those accounts. Ideally, these accounts should be in deactivated state.

-Sri

[Sridhar Bhaskarla]

Dave,

Oops.. I meant "I wouldn't worry".

-Sri

[Rick Garland]

These accounts you can leave alone.

No need to activbate these accts, from a security point these will be more accounts that have access to the system that you would nned to be aware of. Mostly these accounts exist for ownerships (e.g., lp and printing)

[Andrew Cowan]

Its always a good idea to give these accounts a default shell of "/bin/false", or even your own exe that records the attempted use, then kicks them out. This extra step prevents someone from "su'ing", or getting access via a NULL-shell attack.
The only exception to this is "adm" when process-accounting is activated, as it requires a valid shell to execute some of the admin jobs via cron.

[Indira Aramandla]

Hi,

adm - owns accounting files
bin - own executable files for most user commands
daemon - executes system server processes. It is often used for network utilities bin and
sys - are used for system files.
lp - owns printing. It is used for the line printer system ftp is used for ftp obviously.
nobody - used in NFS
www & webadmin - used for www processes

No one can login as these users, as they are disabled. You can relave them as they are.

IA