# Ensure all groups in /etc/passwd exist in /etc/group

The necessity of this control is rooted in maintaining system integrity and enforcing the principle of least privilege. User accounts with non-existent primary group IDs represent a significant misconfiguration. Such accounts can lead to unpredictable system behavior, especially concerning file ownership and permissions, potentially causing applications to fail or creating security vulnerabilities. This misconfiguration could be an indicator of a failed user deletion process, leaving an orphaned account that could be exploited. Auditing this setting ensures that every user account is properly associated with a valid group, which is fundamental for correct access control. The audit script systematically checks for inconsistencies by comparing the group ID (GID) of each user in `/etc/passwd` against the list of valid groups in `/etc/group`. The remediation script corrects this misconfiguration by deleting any user accounts found to have a non-existent primary GID, thus removing the orphaned accounts and restoring system integrity. The recommended state for all security levels (Basic, Moderate, and Strict) is an inconsistency count of 0. There is no acceptable level of deviation for this control; any user account linked to a non-existent group is a security risk that must be rectified immediately. Therefore, a value of 0 is the only compliant state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script designed to run on CentOS 7 or newer. The script must iterate through each user in the `/etc/passwd` file, extract their primary Group ID (GID) from the fourth field, and check if that GID exists in the `/etc/group` file. The script must output only a single integer representing the total count of users whose primary GID does not exist in `/etc/group`.

## Remediation Script Working

Bash script for CentOS 7 or newer that identifies and removes all user accounts listed in `/etc/passwd` whose primary Group ID (GID) is not defined in `/etc/group`. This script should not accept any arguments, as its goal is to enforce full consistency. Upon successful completion, the script must output `true`. If any error occurs during the user deletion process, it must output `false`.

