Check Details

• Resource: Server
• Check: Ensure no duplicate UIDs exist
• Risk: Duplicate UIDs allow multiple users to share the same privileges, leading to loss of accountability and potential unauthorized access.

Remediation Steps

1. Open a terminal session on the server with root or sudo privileges.

2. Run the following script to identify duplicate UIDs in /etc/passwd.

   

   #!/bin/bash
   
   cut -f3 -d":" /etc/passwd | sort -n | uniq -c | while read x ; do
   [ -z "$x" ] && break
   set - $x
     if [ $1 -gt 1 ]; then
       users=$(awk -F: '($3 == n) { print $1 }' n=$2 /etc/passwd | xargs)
   echo "Duplicate UID ($2): $users"
   fi
   done
   

3. Review the output to identify duplicate UIDs and the associated user accounts.

4. Ensure the affected user is not running any processes before making changes:

   

   pkill -u <username>
   

5. For each duplicate UID, assign a unique UID to one of the users using the usermod command.

   

   usermod -u <new_uid> <username>
   

6. After updating the UID, reassign ownership of files from the old UID to the correct user.
   Note: The -xdev flag prevents crossing into other mounted filesystems.

   

   find / -xdev -uid <old_uid> -exec chown -h <username> {} \;
   

7. Verify that each user now has a unique UID by re-running the audit script.
8. Implement regular system audits to prevent future UID duplication issues.