Title

The root account must be the only account with GID of 0. (Cat I impact)

Discussion

Accounts with a GID of 0 have root group privileges.

Check Content

Check passwd and group files for non-root user ids and group ids with a GID of 0. # more /etc/passwd # more /etc/group OR # awk -F: '$4 == 0' /etc/passwd # awk -F: '$3 == 0' /etc/group Confirm the only account with a group id of 0 is root. If the root account is not the only account with GID of 0, this is a finding.

Fix Text

Change the default GID of non-root accounts to a valid GID other than 0.

Additional Identifiers

Rule ID: SV-226422r603265_rule

Vulnerability ID: V-226422

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.