User accounts also provide accountability, and this is not possible with group accounts. Be sure shadow passwords are enabled. See the Password Security section for more information. Regularly audit user accounts for invalid or unused accounts, expired accounts, etc. Check for repeated login failures Be sure to enable quotas, to prevent denial of service attacks involving filling disk partitions, or appending exploits to group-writable files.
Disable group accounts, and unused system accounts, such as sys or uucp .
These accounts should be locked, and given non-functional shells. Many local user accounts that are used in security compromises are ones that have not been used in months or years. Since no one is using them they provide the ideal attack vehicle. The most sought-after account on your machine is the superuser account. This account has authority over the entire machine, which may also include authority over other machines on the network.