Reserved UID/GID (UNIX)

Module: Account Integrity

This check reports users and groups with a user ID or group ID within the range reserved for system accounts that could give them super-user privileges or privileged access to system files. Users and groups that are part of the standard operating system distribution are not reported. Use the name list to include or exclude users for the check (the Users to check option does not apply). Use the Reserved UID ranges and Reserved GID ranges options to customize reserved user ID or group ID ranges.

The following table lists the error messages for the check.

Table: Error messages for Reserved UID/GID

Message String ID and Category	Platform and Message Numeric ID	Message Title and Description	Additional Information
String ID: STKU_PRIVUID Category: ESM Administrative Information	UNIX (5152)	Title: Privileged user Description:The listed accounts have user IDs (UIDs) that either make them super-users (UID 0) or allow them to access system files. These accounts are not part of the normal operating system distribution and can represent a security risk. You should remove the access privileges from these accounts by changing the UIDs to larger, unique values.	Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_PRIVGID Category: ESM Administrative Information	UNIX (5153)	Title: Privileged group Description:The listed groups have group IDs (GIDs) that grant members of the group special access to system files. These groups are not part of the normal operating system distribution and can represent a security risk. You should remove the privileged access from members of these groups by changing the GIDs to larger, unique values.	Severity: red-4 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_PRIV Category: ESM Administrative Information	UNIX (5154)	Title: User has shutdown privileges Description:The listed users have been granted shutdown privileges. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users who should not have shutdown privileges.	Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_SYS Category: ESM Administrative Information	UNIX (5155)	Title: User has shutdown privileges from any system Description:The listed users have been granted shutdown privileges on any system in your cluster. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users that should not have shutdown privileges.	Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_USER Category: ESM Administrative Information	UNIX (5156)	Title: Any user has shutdown privileges from these systems Description:Your system has granted any user shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a system shutdown. You should assign shutdown privileges only to specific users.	Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_SHUTDOWN_ANY_SYS_USER Category: ESM Administrative Information	UNIX (5157)	Title: Any user has shutdown privileges from any system Description:All systems on your cluster have granted all users shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a shutdown. You should assign shutdown privileges only to specific users.	Severity: yellow-1 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]
String ID: STKU_GRPKERNPRIV Category: ESM Administrative Information	UNIX (5158)	Title: Group has kernel capabilities Description:The listed groups have been assigned one or more kernel capabilities. This is a potential security problem if the group has been assigned any kernel capabilities that are not required by users in the group. You should carefully review the list and remove unnecessary kernel capabilities. For more information, read the man pages for the getprivgrp, setprivgrp, and chown commands.	Severity: green-0 Correctable: false Snapshot Updatable: false Template Updatable: false Information Field Format: [%s]

Message String ID and Category

Platform and Message Numeric ID

Message Title and Description

Additional Information

String ID: STKU_PRIVUID

Category: ESM Administrative Information

UNIX (5152)

Title: Privileged user

Description:The listed accounts have user IDs (UIDs) that either make them super-users (UID 0) or allow them to access system files. These accounts are not part of the normal operating system distribution and can represent a security risk. You should remove the access privileges from these accounts by changing the UIDs to larger, unique values.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_PRIVGID

Category: ESM Administrative Information

UNIX (5153)

Title: Privileged group

Description:The listed groups have group IDs (GIDs) that grant members of the group special access to system files. These groups are not part of the normal operating system distribution and can represent a security risk. You should remove the privileged access from members of these groups by changing the GIDs to larger, unique values.

Severity: red-4

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_SHUTDOWN_PRIV

Category: ESM Administrative Information

UNIX (5154)

Title: User has shutdown privileges

Description:The listed users have been granted shutdown privileges. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users who should not have shutdown privileges.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_SHUTDOWN_ANY_SYS

Category: ESM Administrative Information

UNIX (5155)

Title: User has shutdown privileges from any system

Description:The listed users have been granted shutdown privileges on any system in your cluster. This privilege allows the users to disrupt normal system activities and should be granted with care. You should carefully review the list and remove any users that should not have shutdown privileges.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_SHUTDOWN_ANY_USER

Category: ESM Administrative Information

UNIX (5156)

Title: Any user has shutdown privileges from these systems

Description:Your system has granted any user shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a system shutdown. You should assign shutdown privileges only to specific users.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_SHUTDOWN_ANY_SYS_USER

Category: ESM Administrative Information

UNIX (5157)

Title: Any user has shutdown privileges from any system

Description:All systems on your cluster have granted all users shutdown privileges. This privilege allows any user to disrupt normal system activities by initiating a shutdown. You should assign shutdown privileges only to specific users.

Severity: yellow-1

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]

String ID: STKU_GRPKERNPRIV

Category: ESM Administrative Information

UNIX (5158)

Title: Group has kernel capabilities

Description:The listed groups have been assigned one or more kernel capabilities. This is a potential security problem if the group has been assigned any kernel capabilities that are not required by users in the group. You should carefully review the list and remove unnecessary kernel capabilities. For more information, read the man pages for the getprivgrp, setprivgrp, and chown commands.

Severity: green-0

Correctable: false

Snapshot Updatable: false

Template Updatable: false

Information Field Format: [%s]