Accounts: 6 controls for Linux hardening

Pavois audits 6 controls in the Accounts hardening domain, across 9 systems and 4 standards (CIS, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.

The domain in figures

Controls	6
Severities	critical 3high 1medium 1low 1
Evidence gathered	inventory state 6
Standards	CISNIST 800-53PCI DSSDISA STIG
Systems	Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04
Coverage depth	in depth

What does Pavois check in this domain?

inventory state 6: Checked against what is installed or registered, packages present/absent, account databases.

Which standards does this domain cover?

One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.

CIS: 5.3.3.4.1, 5.4.1.6, 5.4.2.1, 5.4.2.2, 7.2.1, 7.2.2, 7.2.3, 8.2.1, 8.2.2, 8.3.1, 8.3.2
NIST 800-53: 3.1.1, 3.5.10, AC-6(5), CM-6(a), IA-2, IA-4(b), IA-5(1)(a), IA-5(c), IA-5(h)
PCI DSS: 2.2.2, 8.2.1, 8.2.2, 8.3.1, 8.3.2, 8.3.5
DISA STIG: UBTU-22-611060, UBTU-22-611065, UBTU-24-300027, UBTU-24-300028

The 6 controls of the Accounts domain

Ref	Rule	Sev.	OS	Standards
SOCLE-CLD-IAM-006	Prevent Login to Accounts With Empty Password	critical	9	cisnistpci-dssstig
SOCLE-CLD-IAM-002	Verify All Account Password Hashes are Shadowed	critical	9	cisnistpci-dss
SOCLE-CLD-IAM-001	Verify Only Root Has UID 0	critical	9	cisnistpci-dss
SOCLE-CLD-IAM-003	Verify Root Has A Primary GID 0	high	9	cispci-dss
SOCLE-CLD-IAM-007	Ensure all users last password change date is in the past	medium	8	cispci-dss
SOCLE-CLD-IAM-005	All GIDs referenced in /etc/passwd must be defined in /etc/group	low	9	cisnistpci-dss

Full control catalogue · All control domains