# Ensure no duplicate user names exist

Necessity: Each user account on a system must have a unique name. The presence of duplicate user names violates the principle of unique identity, which is fundamental to system security and accountability. Duplicate names can lead to unpredictable behavior in applications, incorrect privilege assignments, and ambiguous security logs, making it difficult to trace actions back to a specific user. This misconfiguration can allow one user to inadvertently access another's data or privileges, or it could be exploited by an attacker to obscure malicious activity.

Auditing and Remediation: The audit script checks for non-unique user names by parsing the first field of the `/etc/passwd` file. Remediation for this finding must be a manual process. An automated script cannot safely determine which duplicate account is legitimate or which one should be renamed or removed. Attempting to do so could result in data loss or locking out a valid user. An administrator must investigate the cause of the duplication and take corrective action based on organizational policy.

Recommended State Rationale: There is no acceptable scenario for having duplicate user names on a system. The risk of security policy violations, data access issues, and loss of accountability is significant. Therefore, the recommended state for all hardening levels—Basic, Moderate, and Strict—is the complete absence of duplicate user names. This is a foundational security control with no tolerance for deviation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No Duplicates Found']` |
| **Moderate** | `['No Duplicates Found']` |
| **Strict** | `['No Duplicates Found']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that parses the `/etc/passwd` file to identify any duplicate user names. The script must output a newline-separated list of the duplicate user names. If no duplicates are found, it must return an empty string.

## Remediation Script Working

Due to the destructive nature of removing or renaming user accounts, automated remediation is not recommended. This control requires manual intervention. Therefore, a remediation script that accepts a command-line argument is not applicable. The script should be designed to alert an administrator to the presence of duplicates but must not take any corrective action. It should always return `false` to indicate that manual action is required.

