Cis Ubuntu1204 V110 13 16

13.16 Check That Reserved UIDs Are Assigned to System Accounts (Scored)

Profile Applicability

• Level 1

Description

UIDs below a certain threshold (typically 500 on older systems, 1000 on newer) are reserved for system accounts. Non-system (regular user) accounts should not be assigned UIDs in the reserved range, and reserved UIDs should only belong to recognized system accounts.

Rationale

If a user is assigned a UID that is in the reserved range, even if it is not currently used by a system account, security issues may arise if that UID is later used for a system daemon or service. Ensuring that reserved UIDs are only assigned to known system accounts helps maintain proper access controls and accountability.

Audit Procedure

Using Command Line

This script checks to make sure all accounts with UIDs below 500 are known system accounts.

#!/bin/bash
defUsers="root bin daemon adm lp sync shutdown halt mail news uucp operator games \
gopher ftp nobody dbus usbmuxd vcsa rpc rtkit avahi-autoipd abrt haldaemon gdm ntp \
apache saslauth postfix nfsnobody sshd tcpdump oprofile messagebus pulse list \
gnats proxy www-data backup irc colord syslog libuuid man sys"
/bin/cat /etc/passwd | /usr/bin/awk -F: '($3 < 500) { print $1 " " $3 }' |\
while read user uid; do
  found=0
  for tUser in $defUsers; do
    if [ "$user" = "$tUser" ]; then
      found=1
    fi
  done
  if [ $found -eq 0 ]; then
    echo "User $user has a reserved UID ($uid)."
  fi
done

Expected Result

No output should be returned. Any output indicates non-system accounts using reserved UIDs.

Remediation

Using Command Line

Review the accounts listed and determine if they are legitimate system accounts. If not, assign them a UID above the reserved range (500 or 1000 depending on configuration) using usermod -u <new_uid> <username>, and update file ownerships accordingly.

Default Value

By default, Ubuntu system accounts are assigned UIDs below 500 (or 1000) and regular user accounts are assigned UIDs starting from 1000.

References

• CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0

Profile

Level 1 - Scored