Detections
Analytics

5.4.2.3 Ensure group root is the only GID 0 group

Information

Groups are defined in /etc/group, each identified by a group ID (GID). GID 0 is reserved for the root group, the privileged group associated with the superuser.

If a group other than root is assigned GID 0, it silently shares the privileges of the root group. Such a duplicate is easy to overlook and undermines accountability for access granted through the root group.

Solution

Run the following command to reassign any group other than root that has GID 0 to an unused GID:

# groupmod -g <NEW_GID> <groupname>

Example:

# groupmod -g 200 legacyadmins

If the root group's GID is not 0, run the following command to reset it:

# groupmod -g 0 root

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|4.3

Plugin: Unix

Control ID: a47fec237786839e36fcd1e9f7b3b5124969c52427ab2dbc31b7d948dd3d4d7a