Detections
Analytics
5.4.2.2 Ensure root is the only GID 0 account
Information
The usermod command can be used to specify which group the root account belongs to. This affects permissions of files that are created by the root account.Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.
Solution
Run the following command to set the root user's GID to 0 :# usermod -g 0 root
Run the following command to set the root group's GID to 0 :
# groupmod -g 0 root
Remove any users other than the root user with GID 0 or assign them a new GID if appropriate.
See Also
Item Details
Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION, MEDIA PROTECTION
References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|IA-5, 800-53|MP-2, CSCv7|14.6
Plugin: Unix
Control ID: dde3e73506b1e3378ab9164415ff0d1ffd938c1bc9919102f0fdf6eb39407fe9