Commands Reference, Volume 2

grpck Command

Purpose

Verifies the correctness of a group definition.

Syntax

grpck { -n | -p | -t | -y } { ALL | Group ... }

The grpck command verifies the correctness of the group definitions in the user database files by checking the definitions for ALL the groups or for the groups specified by the Group parameter. If more than one group is specified, there must be a space between the groups.

Note: This command writes its messages to stderr.

You must select a flag to indicate whether the system should try to fix erroneous attributes. The following attributes are checked:

name	Checks the uniqueness and composition of the group name. The group name must be a unique string of eight bytes or less. It cannot begin with a + (plus sign), a : (colon), a - (minus sign), or a ~ (tilde). It cannot contain a colon (:) in the string and cannot be the ALL or default keywords. No system fix is possible.
groupID	Checks the uniqueness and composition of the group ID. The ID must not be null and must consist of decimal digits only. No system fix is possible.
users	Checks the existence of the users listed in the group database files. If you indicate that the system should fix errors, it will delete all the users that are not found in the user database files.
adms	Checks the existence of the users listed as group administrators in the group database files. If you indicate that the system should fix errors, it will delete all the administrators that are not found in the user database files.

admin

Checks for a valid admin attribute for each group in the /etc/security/group file. No system fix is available.

Generally, the sysck command calls the grpck command as part of the verification of a trusted-system installation. In addition, the root user or a member of the security group can enter the command.

The grpck command checks to see if the database management security files (/etc/passwd.nm.idx, /etc/passwd.id.idx, /etc/security/passwd.idx, and /etc/security/lastlog.idx) files are up-to-date or newer than the corresponding system security files. Please note, it is alright for the /etc/security/lastlog.idx to be not newer than /etc/security/lastlog. If the database management security files are out-of-date, a warning message appears indicating that the root user should run the mkpasswd command.

Flags

-n	Reports errors but does not fix them.
-p	Fixes errors but does not report them.
-t	Reports errors and asks if they should be fixed.
-y	Fixes errors and reports them.

Security

Access Control: This command should grant execute (x) access to the root user and members of the security group. The command should be setuid to the root user and have the trusted computing base attribute.

Files Accessed:

Mode	File
r	/etc/passwd
r	/etc/security/user
rw	/etc/security/group
rw	/etc/group

Auditing Events:

Event	Information
GROUP_User	user, groups, attribute \| error, status
GROUP_Adms	user, groups, attribute \| error, status

Examples

To verify that all the group members and administrators exist in the user database, and have any errors reported (but not fixed), enter:
grpck -n ALL
To verify that all the group members and administrators exist in the user database and to have errors fixed, but not reported, enter:
grpck -p ALL
To verify the uniqueness of the group name and group ID defined for the install group, enter:
grpck -n install
OR
grpck -t install
OR
grpck -y install
The grpck command does not correct the group names and IDs. Therefore, the -n, -t and -y flags report problems with group names and group IDs, but do not correct them.

Files

/usr/sbin/grpck	Contains the grpck command.
/etc/passwd	Contains the basic attributes of users.
/etc/security/user	Contains the extended attributes of users.
/etc/group	Contains the basic attributes of groups.
/etc/security/group	Contains the extended attributes of groups.

Related Information

The pwdck command, sysck command, usrck command.

For more information about the identification and authentication of users, discretionary access control, the trusted computing base, and auditing, refer to Security Administration in AIX 5L Version 5.1 System Management Concepts: Operating System and Devices.