Keep the user and group databases consistent

Description

The account databases (/etc/passwd, /etc/shadow, /etc/group, /etc/gshadow) must be consistent: each user and group name and each UID and GID is unique, every primary group of a user exists, and every passwd entry has a shadow entry. pwck -r and grpck -r check these rules without changing anything.

Rationale

Two accounts with the same UID are the same user for the kernel: files, processes and logs cannot tell them apart. Duplicates and dangling entries are often the trace of a manual edit or of an attacker adding an account.

Impact

None. The check is read-only; fixes need a human decision.

Audit

1. Run pwck -r and grpck -r. They must report nothing, apart from missing home directories of system accounts (lp, news, www-data...), which Debian does not create.
2. cut -d: -f3 /etc/passwd | sort | uniq -d and cut -d: -f3 /etc/group | sort | uniq -d print nothing.

Automated: every check must pass. Scanners report each check by its id.

pwck

script: |
  out=$(pwck -r 2>&1 | grep -v -e "directory '.*' does not exist" -e '^pwck: no changes$')
  echo "${out:-pwck: no problem (missing system homes ignored)}"
  [ -z "$out" ]

grpck

script: |
  out=$(grpck -r 2>&1); rc=$?
  echo "${out:-grpck: no problem}"
  [ "$rc" -eq 0 ]

duplicate-ids

script: |
  u=$(cut -d: -f3 /etc/passwd | sort | uniq -d | tr '\n' ' ')
  g=$(cut -d: -f3 /etc/group | sort | uniq -d | tr '\n' ' ')
  echo "duplicate UIDs: ${u:-none}; duplicate GIDs: ${g:-none}"
  [ -z "$u$g" ]

Remediation

Investigate each reported entry: a duplicate UID 0 or an unknown account may be malicious. Fix with usermod, groupmod, userdel and groupdel, or interactively with pwck and grpck (without -r).

References

• pwck(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• grpck(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle