I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document),
sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt
From a historical perspective, these accounts were set up so that one could log in at the physical console with these accounts' credentials (traditionally they shipped with a null password, so all you needed was to enter the user name) and properly shut down a system without having to provide the root password.
This could be useful in the case of a desktop workstation, but is questionable in the case of a server system. I don't recall there ever being any protections against logging in from remote terminals or the Internet with these accounts (unlike root itself) and shutting down the system, which creates an extreme risk of a DoS attack. Therefore, best practices have dictated for years that these accounts be removed on sight, or at the very least, locked like all other default accounts to prevent use. As default accounts go, these are probably the most dangerous.
So I'm wondering if the OS vendors have finally gotten the clue not to ship systems with these rather egregious defaults, or if there is still any purpose for having them around?