# Cis Ubuntu2004 V300 7 2 3

> Ensure all groups in /etc/passwd exist in /etc/group

- Skill: `cyberstrikeus/cis-ubuntu2004-v300-7-2-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ubuntu2004-v300-7-2-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ubuntu2004-v300-7-2-3/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ubuntu2004-v300-7-2-3

---


# 7.2.3 Ensure all groups in /etc/passwd exist in /etc/group (Automated)

## Profile

- Level 1 - Server
- Level 1 - Workstation

## Description

Over time, system administration errors and changes can lead to groups being defined in `/etc/passwd` but not in `/etc/group`.

## Rationale

Groups defined in the `/etc/passwd` file but not in the `/etc/group` file pose a threat to system security since group permissions are not properly managed.

## Impact

None

## Audit Procedure

### Command Line

Run the following script to verify all GIDs in `/etc/passwd` exist in `/etc/group`:

```bash
#!/usr/bin/env bash

{
    a_passwd_group_gid=("$(awk -F: '{print $4}' /etc/passwd | sort -u)")
    a_group_gid=("$(awk -F: '{print $3}' /etc/group | sort -u)")
    a_passwd_group_diff=("$(printf '%s\n' "${a_group_gid[@]}" "${a_passwd_group_gid[@]}" | sort | uniq -u)")
    while IFS= read -r l_gid; do
        awk -F: '($4 == "$l_gid") {print " - User: \"" $1 "\" has GID: \"" $4 "\" which does not exist in /etc/group" }' /etc/passwd
    done < <(printf '%s\n' "${a_passwd_group_gid[@]}" "${a_passwd_group_diff[@]}" | sort | uniq -D | uniq)
    unset a_passwd_group_gid; unset a_group_gid; unset a_passwd_group_diff
}
```

Nothing should be returned.

## Expected Result

No output should be returned.

## Remediation

### Command Line

Analyze the output of the Audit step above and perform the appropriate action to correct any discrepancies found.

## Default Value

N/A

## References

1. NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5

## CIS Controls

| Controls Version | Control                                                                      | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 3.3 Configure Data Access Control Lists                                      | X    | X    | X    |
| v8               | 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents | X    | X    | X    |

MITRE ATT&CK Mappings:

| Techniques / Sub-techniques | Tactics | Mitigations |
| --------------------------- | ------- | ----------- |
| T1222, T1222.002            | TA0003  | M1027       |