# Ensure all groups in /etc/passwd exist in /etc/group

Necessity: This control ensures system database integrity. Every user account defined in `/etc/passwd` must belong to a primary group that exists in `/etc/group`. An inconsistency, where a user is assigned to a non-existent group ID (GID), can lead to unpredictable behavior regarding file permissions and resource access. This misconfiguration may arise from improper user deletion or manual file corruption and poses a security risk, as a new group created later could inadvertently inherit that GID, granting unintended permissions.

Auditing and Remediation: The audit script cross-references the two files, comparing each user's GID in `/etc/passwd` against the list of valid GIDs in `/etc/group` to detect orphaned entries. The remediation script corrects these inconsistencies by reassigning affected users to a pre-defined, safe, and unprivileged group, thereby restoring the integrity of the user and group configuration.

Recommended State Rationale: This is a binary control focused on system integrity; the system is either consistent or it is not. There are no degrees of compliance. Therefore, the recommended state for Basic, Moderate, and Strict security levels is identical: the system must be fully compliant, with no users assigned to non-existent groups. Any deviation from this state is considered a flaw that must be corrected immediately.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that returns 'true' if every user's primary Group ID (GID) listed in the fourth field of `/etc/passwd` exists as a GID in the third field of `/etc/group`. If any GID from `/etc/passwd` is not found in `/etc/group`, the script must return 'false'. The output must contain only the boolean value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument. The script should verify that the argument is the string 'compliant'. If so, it will find all users in `/etc/passwd` whose primary GID does not exist in `/etc/group` and change their primary group to a safe default (e.g., 'nogroup'). The script must return 'true' on successful completion (if changes were made or no changes were needed) and 'false' if the argument is incorrect or if any operation fails.

