Title

The root account must be the only account having an UID of 0. (Cat II impact)

Discussion

If an account has an UID of 0, it has root authority. Multiple accounts with an UID of 0 afford more opportunity for potential intruders to guess a password for a privileged account.

Check Content

Check the system for duplicate UID 0 assignments by listing all accounts assigned UID 0. Procedure: # grep ":0:" /etc/passwd | awk -F":" '{print$1":"$3":"}' | grep ":0:" If any accounts other than root are assigned UID 0, this is a finding.

Fix Text

Remove or change the UID of accounts other than root that have UID 0.

Additional Identifiers

Rule ID: SV-773r2_rule

Vulnerability ID: V-773

Group Title: GEN000880

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.