La commande 'grpck' permet de contrôler la bonne définition des groupes dans le fichier /etc/group.
Si un utilisateur est défini dans le fichier mais n'existe pas dans '/etc/passwd', le programme vous l'indique.
La commande la plus simple est 'grpck -n ALL'.
Ci-dessous la documentation officielle sur la commande en V6.1.
Purpose
Verifies the correctness of a group definition. This document describes both the AIX® grpck command and the System V grpck command.
Syntax
grpck { -n | -p | -t | -y } { ALL | Group ... }
Description
The grpck command verifies the correctness of the group definitions in the user database files by checking the definitions for ALL the groups or for the groups specified by the Group parameter. If more than one group is specified, there must be a space between the groups.
Note: This command writes its messages to stderr.
You must select a flag to indicate whether the system should try to fix erroneous attributes. The following attributes are checked:
| admin | Checks for a valid admin attribute for each group in the /etc/security/group file. No system fix is available. |
Generally, the sysck command calls the grpck command as part of the verification of a trusted-system installation. In addition, the root user or a member of the security group can enter the command.
The grpck command checks to see if the database management security files (/etc/passwd.nm.idx, /etc/passwd.id.idx, /etc/security/passwd.idx, and/etc/security/lastlog.idx) files are up-to-date or newer than the corresponding system security files. Please note, it is alright for the /etc/security/lastlog.idxto be not newer than /etc/security/lastlog. If the database management security files are out-of-date, a warning message appears indicating that the root user should run the mkpasswd command.
Flags
| -n | Reports errors but does not fix them. |
| -p | Fixes errors but does not report them. |
| -t | Reports errors and asks if they should be fixed. |
| -y | Fixes errors and reports them. |
Security
Access Control: This command should grant execute (x) access to the root user and members of the security group. The command should be setuid to the root user and have the trusted computing base attribute.
Files Accessed:
| Mode | File |
|---|---|
| r | /etc/passwd |
| r | /etc/security/user |
| rw | /etc/security/group |
| rw | /etc/group |
Auditing Events:
| Event | Information |
|---|---|
| GROUP_User | user, groups, attribute | error, status |
| GROUP_Adms | user, groups, attribute | error, status |
Attention RBAC users and Trusted AIX users: This command can perform privileged operations. Only privileged users can run privileged operations. For more information about authorizations and privileges, see Privileged Command Database in Security. For a list of privileges and the authorizations associated with this command, see the lssecattr command or the getcmdattr subcommand.
Examples
- To verify that all the group members and administrators exist in the user database, and have any errors reported (but not fixed), enter:
grpck -n ALL
- To verify that all the group members and administrators exist in the user database and to have errors fixed, but not reported, enter:
grpck -p ALL
- To verify the uniqueness of the group name and group ID defined for the install group, enter:
grpck -n installORgrpck -t installORgrpck -y installThe grpck command does not correct the group names and IDs. Therefore, the -n, -t and -y flags report problems with group names and group IDs, but do not correct them.
Files
| /usr/sbin/grpck | Contains the grpck command. |
| /etc/passwd | Contains the basic attributes of users. |
| /etc/security/user | Contains the extended attributes of users. |
| /etc/group | Contains the basic attributes of groups. |
| /etc/security/group | Contains the extended attributes of groups. |
Related Information
The pwdck command, sysck command, usrck command.
For more information about the identification and authentication of users, discretionary access control, the trusted computing base, and auditing, refer to Security.
System V grpck command
Syntax
/usr/sysv/bin/grpck
Description
The /usr/sysv/bin/grpck command verifies the correctness of the group definitions in the user database files by checking the definitions for ALL the groups.This/usr/sysv/bin/grpck command is a System V version of the existing grpck command in /usr/sbin/.This command calls the /usr/sbin/grpck command with -nand ALL options.
Exit Status
- 0
- Successful completion.
- >0
- An error occurred.
Examples
- To verify that all the group members and administrators exist in the user database, and have any errors reported (but not fixed), enter:
/usr/sysv/bin/grpck
Files
- /usr/sysv/bin/grpck
- Contains the System V version of the grpck command.
- usrck : Validation de définition utilisateur
