Detections
Analytics

5.4.2.2 Ensure root is the only GID 0 account

Information

An account's primary group is identified by the group ID (GID) in its /etc/passwd entry. GID 0 is the root group, which the root account uses as its primary group by default.

Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.

Solution

Run the following command to reassign any account other than root that has primary GID 0 to an appropriate group:

# usermod -g <NEW_GID> <username>

Example:

# usermod -g 100 bsmith

If the root account's primary GID is not 0, run the following command to reset it:

# usermod -g 0 root

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, CSCv7|4.3

Plugin: Unix

Control ID: 70988ebc84f3fa9e5eac42fc4c63e5b0280f8db1b1b7e89a8dbebd4b6ae9db85