7.1 Disable System Accounts - should pass if the default shell for 'noaccess' is set to /usr/bin/fal

There are a number of accounts provided with the Solaris OS that are used to manage applications and are not intended to provide an interactive shell.

Solution:

Accounts that have been locked are prohibited from running commands on the system. Such accounts are not able to login to the system nor are they able to use scheduled execution facilities such as cron. To lock an account, use the command-

passwd -l [username]

Policy Value:

expect: noaccess:x:.+:/usr/bin/false

file: /etc/passwd

regex: ^[\s\t]*noaccess:x:.*

system: SunOS