Check Details

• Resource: Server
• Check: Ensure no duplicate GIDs exist
• Risk: Duplicate GIDs allow multiple groups to share the same permissions, leading to improper access control and security risks.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Run the following script to identify duplicate GIDs in /etc/group.

   

   #!/bin/bash
   
   cut -f3 -d":" /etc/group | sort -n | uniq -c | while read x ; do
   [ -z "$x" ] && break
   set - $x
     if [ $1 -gt 1 ]; then
       groups=$(awk -F: '($3 == n) { print $1 }' n=$2 /etc/group | xargs)
   echo "Duplicate GID ($2): $groups"
   fi
   done
   

3. Review the output to identify duplicate GIDs and the associated groups.

4. For each duplicate GID, determine the correct group ownership:

   

   # List all files owned by the duplicate GID
   find / -gid <duplicate_gid> -ls 2>/dev/null
   
   # Check group membership
   
   grep <group_name> /etc/group
   
   # View group details
   
   getent group <group_name>
   
   

5. Assign a new unique GID to the conflicting group using the groupmod command.

   

   groupmod -g <new_gid> <groupname>
   

6. After updating the GID, reassign group ownership of files from the old GID.

   

   # Update file group ownership using group name
   
   find / -gid <old_gid> -exec chgrp <groupname> {} \; 2>/dev/null
   
   # OR using numeric GID
   
   find / -gid <old_gid> -exec chgrp <new_gid> {} \; 2>/dev/null
   

7. Verify that all groups now have unique GIDs by re-running the audit script.
8. Implement regular system audits to prevent future GID duplication issues.