Skip to content

0005-user-group-exist - Host /etc/group does not exist¶

Rule ID¶

0005-user-group-exist

Category¶

system

Severity¶

critical

Compatible Versions¶

Linux

Description¶

Monitor whether /etc/group exists on the host

Scan Frequency¶

1 */5 * * *

Rationale¶

In Linux, each user has a corresponding record line in the /etc/group file, which records some basic attributes of the user. System administrators often modify this file to complete user management. If /etc/group is deleted, the host cannot log in, which constitutes malicious destruction.

Risk Items¶

Hacker Infiltration
Data Leak

Audit Method¶

Verify whether /etc/group exists on the host. You can run the following command to verify:

ls /etc/group

Remediation¶

If the system has not been restarted after /etc/group is deleted, you can run the following command to remediate:
```
cp /etc/group
/etc/group
```
If the system is shut down after deleting the file, you will not be able to log in when booting.
During GRUB boot, press e to enter edit mode, modify the ro on the linux16 line to rw rd.break

Press Ctrl+X to execute

After entering single-user mode, change the root path and copy the init program in
```
```bash
chroot /sysroot

cp /etc/group
```
/etc/group ```

Because the security context of the copied file does not match the current directory, you need to disable SELinux
```
```bash
vim /etc/sysconfig/selinux

selinux = disabled
```
```
Exit the current root twice with exit and restart the host to restore normal operation

Impact¶

None

Default Value¶

None

References¶

CIS Controls¶

None