Detections
Analytics

5.4.2.2 Ensure root is the only GID 0 account

Information

An account's primary group is identified by the group ID (GID) in its /etc/passwd entry. GID 0 is the root group, which the root account uses as its primary group by default.

Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.

Solution

Run the following command to reassign any account other than root that has primary GID 0 to an appropriate group:

# usermod -g <NEW_GID> <username>

Example:

# usermod -g 100 bsmith

If the root account's primary GID is not 0, run the following command to reset it:

# usermod -g 0 root

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|4.3

Plugin: Unix

Control ID: 2a4c2915e26f0938812ce3ab72e9621ccb0ab9470ff4632671eaaf713075bef7