Title

The root account must be the only account having a UID of “0”. (Cat II impact)

Discussion

If an account has a UID of “0”, it has root authority. Multiple accounts with a UID of “0” afford more opportunity for potential intruders to guess a password for a privileged account.

Check Content

Enter the following command to view users with a UID of "0": grep :0 /etc/passwd If any user other than root has a UID of "0", this is a finding.

Fix Text

Edit the /etc/passwd file and change the UID of the duplicate to an unused UID.

Additional Identifiers

Rule ID: SV-37848r1_rule

Vulnerability ID: V-773

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.