Detections
Analytics

7.2.3 Ensure all groups in /etc/passwd exist in /etc/group

Information

Over time, system administration errors and changes can lead to groups being defined in /etc/passwd but not in /etc/group.

Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.

Solution

Based on the Audit Procedure output, for each local interactive user whose primary group ID (the fourth field of the user's /etc/passwd entry) has no matching group in /etc/group, follow local site policy and perform one of the following:

 - If the group is legitimate and should exist, create it with the reported GID:

# groupadd -g <GID> <groupname>

 - If the user should instead belong to an existing group, change the user's primary group to a valid one:

# usermod -g <groupname> <username>

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: Unix

Control ID: 7cb2058d168299cf25a0ebef8a50ecd8715a1059553e610a6398841c10c9b257