5.5.3 Ensure default group for the root account is GID 0

Information

The usermod command can be used to specify which group the root user belongs to. This affects permissions of files that are created by the root user.

Rationale:

Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.

Solution

Run the following command to set the root user default group to GID 0 :

# usermod -g 0 root

See Also

https://workbench.cisecurity.org/files/3219

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv7|14.6

Plugin: Unix

Control ID: 360d86f5968a7c2579345bd0ef0ccbe43f95427b40104f08cd7f5e1dc937b483