| name | cis-ubuntu1604-v200-6-2-3 |
| description | Ensure all groups in /etc/passwd exist in /etc/group |
| category | cis-iam |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-16.04","user-management","maintenance"] |
| cis_id | 6.2.3 |
| cis_benchmark | CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 6.2.3
Profile
- Level: 1 - Server
- Level: 1 - Workstation
- Assessment Status: Automated
Description
Over time, system administration errors and changes can lead to groups being defined in /etc/passwd but not in /etc/group.
Rationale
Groups defined in the /etc/passwd file but not in the /etc/group file pose a threat to system security since group permissions are not properly managed.
Audit Procedure
Command Line
Run the following script and verify no results are returned:
#!/bin/bash
for i in $(cut -s -d: -f4 /etc/passwd | sort -u ); do
grep -q -P "^.*?:[^:]*:$i:" /etc/group
if [ $? -ne 0 ]; then
echo "Group $i is referenced by /etc/passwd but does not exist in /etc/group"
fi
done
Expected Result
No output should be returned.
Remediation
Command Line
Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found.
Default Value
N/A
References
N/A
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v7 | 16.6 Maintain an Inventory of Accounts
Maintain an inventory of all accounts organized by authentication system. | | | |
| v7 | 16.7 Establish Process for Revoking Access
Establish and follow an automated process for revoking system access by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor. Disabling these accounts, instead of deleting accounts, allows preservation of audit trails. |
