Skip to content

SLEM 5 must never automatically remove or disable emergency administrator accounts.

An XCCDF Rule

Description

Emergency administrator accounts, also known as "last resort" or "break glass" accounts, are local logon accounts enabled on the system for emergency use by authorized system administrators to manage a system when standard logon methods are failing or not available. Emergency accounts are not subject to manual removal or scheduled expiration requirements.

ID
SV-261356r996518_rule
Version
SLEM-05-411050
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Configure SLEM 5 to never automatically remove or disable emergency administrator accounts.

     > sudo chage -I -1 -M 99999 <emergency_administrator_account_name>