SLEM 5 must never automatically remove or disable emergency administrator accounts.
An XCCDF Rule
Description
Emergency administrator accounts, also known as "last resort" or "break glass" accounts, are local logon accounts enabled on the system for emergency use by authorized system administrators to manage a system when standard logon methods are failing or not available. Emergency accounts are not subject to manual removal or scheduled expiration requirements.
- ID
- SV-261356r996518_rule
- Version
- SLEM-05-411050
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure SLEM 5 to never automatically remove or disable emergency administrator accounts.
> sudo chage -I -1 -M 99999 <emergency_administrator_account_name>