Unprotected account
Summary
Accounts with simple or no passwords.
Impact
A unauthorized user could gain access to the system.
Background
Some system accounts such as sync, lp, or date do not have passwords. They
allow someone to get information by logging into one of the accounts.
The problem
A cracker could exploit system holes to subvert these accounts.
Fix
- Remove the account from the system and/or passwd file.
- Disable these accounts by placing an asterisk ("*") in the password
field of the account in the passwd file.