UNIX for Dummies Questions & Answers

You guys tell me. Am I wrong on this one? If so, where is the hole in my thoughts?

Thanks,

Duke


Specs:

Solaris version of Unix

"ROOT" primary group is "other" (GID = 1)

Application account (not system account) is assigned to the "other" GID (1).

Issue:

Application account and "ROOT" have the same GID of 1 (designated as "other")

Risk:

If the application account is compromised it could lead to a ROOT compromise because the "other" group is a system group. Also, it could allow the application account unauthorized access to other systems in the network where the group ID "1" (other group ID) is assigned to another group name.

System groups should only be assigned to disabled system accounts because of inconsistency between platform group assignments and the existence of powerful system groups on some Unix systems.

Solution

Remove the application account from the system GID of 1 "other".

By the way, I did search before posting this. So I either 1. Didn't search very well or 2. Was appropriate in posting this question as it hasn't yet been addressed. (I hope it's #2 as I don't want to look like an idiot on my 1st post)

I don't know of any application account that needs to be part of the root group. Is it homegrown?
Anyway, I'd move it to it's own group.

Yeah it's a homegrown security application.

My agrument is that it shouldn't be apart of the GID = 1, which is "other" on SUN Unix but could be "bin" on Linux. There are too many flavors of Unix with no standard on GIDs, so you run the risk of having inappropriate privileged access.

So I had them move it to it's own separate group that wasn't a designated system GID.

Duke