# Cis Ubuntu1204 V110 13 16

> Check That Reserved UIDs Are Assigned to System Accounts

- Skill: `cyberstrikeus/cis-ubuntu1204-v110-13-16` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ubuntu1204-v110-13-16`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ubuntu1204-v110-13-16/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ubuntu1204-v110-13-16

---


# 13.16 Check That Reserved UIDs Are Assigned to System Accounts (Scored)

## Profile Applicability

- Level 1

## Description

UIDs below a certain threshold (typically 500 on older systems, 1000 on newer) are reserved for system accounts. Non-system (regular user) accounts should not be assigned UIDs in the reserved range, and reserved UIDs should only belong to recognized system accounts.

## Rationale

If a user is assigned a UID that is in the reserved range, even if it is not currently used by a system account, security issues may arise if that UID is later used for a system daemon or service. Ensuring that reserved UIDs are only assigned to known system accounts helps maintain proper access controls and accountability.

## Audit Procedure

### Using Command Line

This script checks to make sure all accounts with UIDs below 500 are known system accounts.

```bash
#!/bin/bash
defUsers="root bin daemon adm lp sync shutdown halt mail news uucp operator games \
gopher ftp nobody dbus usbmuxd vcsa rpc rtkit avahi-autoipd abrt haldaemon gdm ntp \
apache saslauth postfix nfsnobody sshd tcpdump oprofile messagebus pulse list \
gnats proxy www-data backup irc colord syslog libuuid man sys"
/bin/cat /etc/passwd | /usr/bin/awk -F: '($3 < 500) { print $1 " " $3 }' |\
while read user uid; do
  found=0
  for tUser in $defUsers; do
    if [ "$user" = "$tUser" ]; then
      found=1
    fi
  done
  if [ $found -eq 0 ]; then
    echo "User $user has a reserved UID ($uid)."
  fi
done
```

## Expected Result

No output should be returned. Any output indicates non-system accounts using reserved UIDs.

## Remediation

### Using Command Line

Review the accounts listed and determine if they are legitimate system accounts. If not, assign them a UID above the reserved range (500 or 1000 depending on configuration) using `usermod -u <new_uid> <username>`, and update file ownerships accordingly.

## Default Value

By default, Ubuntu system accounts are assigned UIDs below 500 (or 1000) and regular user accounts are assigned UIDs starting from 1000.

## References

- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0

## Profile

Level 1 - Scored