Detections
Analytics

7.2.4 Ensure no duplicate UIDs exist

Information

Although the useradd program will not let you create a duplicate User ID (UID), it is possible for an administrator to manually edit the /etc/passwd file and change the UID field.

Users must be assigned unique UIDs for accountability and to ensure appropriate access protections.

Solution

Based on the Audit Procedure output, for each UID shared by more than one account, keep the UID on the correct account and assign a new, unused UID to each of the other accounts:

# usermod -u <UID> <username>

usermod reassigns ownership of files in the account's home directory automatically. Review any other files owned by the previously shared UID and reassign ownership to the correct account as appropriate.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Unix

Control ID: bee7e25395ab1f74073a1a5764acd276db0935c429f9d3f677ebb095fec13059