Ensure group names and GIDs are unique

チェック方法

監査方法: シェルコマンド

command -v cut >/dev/null 2>&1 || exit 1; out=$( { cut -d: -f1,3 /etc/group | sort -u | cut -d: -f2 | sort -n | uniq -d; cut -d: -f1,3 /etc/group | sort -u | cut -d: -f1 | sort | uniq -d ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

期待される出力

compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Examine the group IDs (GID) of all locally configured accounts: cut -d: -f "1 3" /etc/group | sort -u | cut -d: -f 2 | sort -n | uniq -d If the command has output there is at least one duplicate GID number. Determine any duplicates within the /etc/group file: cut -d: -f "1 3" /etc/group | sort -u | cut -d: -f 2 | sort -n | uniq -d | while read GID; do cut -f "1 3 4" -d : /etc/group | /usr/bin/sort -t: -k2n | grep ":${GID}:" done Examine the names of all locally configured groups: cut -d: -f "1 3" /etc/group | sort -u | cut -d: -f 1 | sort | uniq -d If the command has output there is at least one duplicate group name. Determine any duplicates within the /etc/group file: cut -d: -f "1 3" /etc/group | sort -u | cut -d: -f 1 | sort | uniq -d | while read groupname; do cut -f "1 3 4" -d : /etc/group | /usr/bin/sort -t: -k2n | grep "${groupname}:" done NOTE: Any duplicates returned should either be deleted or have the GID changed. Be careful. We recommend you examine any accounts assigned to a duplicate and ensure the account is neither losing nor gaining authorized group access through any remedial action. To remove: rmgroup <groupname> To change the GID: chgroup id=<id> <groupname>

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

tmaegis scan --target aix