Detections
Analytics

7.2.5 Ensure no duplicate GIDs exist

Information

Although the groupadd program will not let you create a duplicate Group ID (GID), it is possible for an administrator to manually edit the /etc/group file and change the GID field.

User groups must be assigned unique GIDs for accountability and to ensure appropriate access protections.

Solution

Based on the Audit Procedure output, for each GID shared by more than one group, keep the GID on the correct group and assign a new, unused GID to each of the other groups:

# groupmod -g <GID> <groupname>

Review any files group-owned by the previously shared GID and reassign group ownership to the correct group as appropriate.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: Unix

Control ID: 6caa5521f224287ce002d59d9f883bb3ef6f311c9fc28ef080979e298d6ac84a