Details
The BIND user account, named by default, must not be used as a regular login account, and should be assigned an invalid or nologin shell to ensure that the account cannot be used to login.
Rationale:
Service accounts such as the named account represent a risk if they can be used to get a login shell to the system.
Solution
Change the named account to use the nologin shell as shown:
# chsh -s /sbin/nologin named
Default Value:
/sbin/nologin
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.