L.S.,
standard the service account cisco-amp-scan-svc gets created on linux servers using a uid lower than $UID_MIN (normally 1000) and as shell "/bin/false". However, the CIS security baselines state that system accounts (accounts with a uid lower than $UID_MIN) should have specified "/sbin/nologin" or "/usr/sbin/nologin" as their shell. Why is Cisco not following this baseline?
I've read that changing this shell also lead to issues (see CSCvw81151). Is this still in issue in version 1.24?
Kind regards, Ronald van Gogh
