# Ensure no duplicate GIDs exist

Necessity: Group IDs (GIDs) are a fundamental component of the Linux security model, used to determine file and resource permissions. If multiple groups share the same GID, the system treats them as the same entity for access control purposes. This breaks the principle of least privilege, as members of one group may gain unintended access to resources owned by another. This misconfiguration can lead to privilege escalation, data exposure, and unpredictable system behavior.

Auditing and Remediation: The audit script checks for this condition by parsing the `/etc/group` file, counting all GID occurrences, and reporting how many GIDs are used more than once. The desired result is zero. Remediation is a manual process because an automated script cannot safely determine which group should be changed. The provided remediation script instruction outlines a tool to be used by an administrator, who must first identify a non-conflicting GID and the correct group to modify, then use the script to apply the `groupmod` command to resolve the conflict.

Recommended State Rationale: The only secure state is to have zero duplicate GIDs. Any duplication creates a critical vulnerability in the system's access control integrity. Therefore, the recommended state for Basic, Moderate, and Strict hardening levels is identical: a count of 0 duplicate GIDs. There is no acceptable level of risk associated with this misconfiguration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that counts the number of unique Group IDs (GIDs) that are duplicated in the /etc/group file. The script must return only the integer representing this count, with no extra text or formatting. A value of 0 indicates no duplicates exist.

## Remediation Script Working

Bash script that requires two positional arguments: the name of a group to modify (`group_name`) and a new, unique GID (`new_gid`). The script must use the `groupmod -g <new_gid> <group_name>` command to apply the change. This script is intended for manual intervention to resolve a specific duplicate identified by the audit. It must return `true` on success and `false` on failure.

