Detections
Analytics

7.2.7 Ensure no duplicate group names exist

Information

Although the groupadd program will not let you create a duplicate group name, it is possible for an administrator to manually edit the /etc/group file and change the group name.

If a group is assigned a duplicate group name, it will create and have access to files with the first GID for that group in /etc/group . Effectively, the GID is shared, which is a security problem.

Solution

Based on the Audit Procedure output, for each duplicated group name, determine which entry is correct and make each group name unique. Use vigr to safely edit the group database and either remove the redundant entry or rename it to a unique group name:

# vigr

File group ownerships will reflect the change automatically as long as each group has a unique GID.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: Unix

Control ID: 27fb936c26ce4ccaa3672e8318a767203f47c91a58be060d17e23120b06ed078