Ensure default group for the root account is GID 0

HighLevel 1Automatedfreebsd

Description

The usermod command can be used to specify which group the root account belongs to. This affects permissions of files that are created by the root account. Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

How it is checked

Audit method: Shell command

shell

awk -F: '$1=="root"{print $1":"$4}' /etc/passwd

Expected output: root:0

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to set the root user's default group ID to 0: # pw usermod -g 0 root

Properties

Operating systems: Any
Tags: freebsdaccounts
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 4.5.2.1 Ensure default group for the root account is GID 0

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd