---
title: "HOST-USR-008 Duplicate Group IDs or Account Names"
canonical: https://openvapt.com/checks/HOST-USR-008.html
html: https://openvapt.com/checks/HOST-USR-008.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-USR-008 Duplicate Group IDs or Account Names

Checks /etc/group for duplicate GIDs and group names, and /etc/passwd for duplicate user names.

- Domain: Server
- Severity: Medium
- Control category: Identity and Authentication
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-286
- NIST SP 800-53 Rev. 5: AC-2, AC-3
- Benchmark topic: No duplicate GIDs, group names or user names (topic only, no benchmark text)

## Why It Matters

Two groups with one GID are the same group to the kernel, so file permissions granted to one are granted to both. Duplicate names make tools and audit logs act on the wrong entry, and are a sign that the account files were edited by hand or by a broken script.

## How It Detects

Reads /etc/group and /etc/passwd and reports any GID, group name or user name that appears more than once (HOST-USR-004 covers duplicate UIDs).

## How to Fix

groupmod -g <new-gid> <group>  for one of each duplicate pair, then fix file ownership (find / -xdev -gid <old-gid>); remove or rename the duplicate name entries with vigr and vipw, which lock the files while editing.

## How to Verify

```
cut -d: -f3 /etc/group | sort | uniq -d ; cut -d: -f1 /etc/group /etc/passwd | sort | uniq -d  print nothing.
```

## Learn the Theory

- [P7 Identity, Passwords and Privilege](https://openvapt.com/academy/p7.md)
- [P15 Access Control: Accounts, Sudo and Logins](https://openvapt.com/academy/p15.md)
- [P20 Secrets, Cron and Account Hygiene](https://openvapt.com/academy/p20.md)

## References

- [group(5), Linux man-pages](https://man7.org/linux/man-pages/man5/group.5.html)
- [passwd(5), Linux man-pages](https://man7.org/linux/man-pages/man5/passwd.5.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go

Run it: `openvapt scan --only HOST-USR-008`. Read it offline: `openvapt explain HOST-USR-008`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-USR-008.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.