documentation_complete: true

title: 'Verify Only Root Has UID 0'

description: |-
    If any account other than root has a UID of 0,
    this misconfiguration should be investigated and the
    accounts other than root should be removed or have their UID changed.

rationale: |-
    An account has root authority if it has a UID of 0. Multiple accounts
    with a UID of 0 afford more opportunity for potential intruders to
    guess a password for a privileged account. Proper configuration of
    sudo is recommended to afford multiple system administrators
    access to root privileges in an accountable manner.

severity: medium

identifiers:
    cce: 26971-2

references:
    disa: 366
    nist: AC-6,IA-2(1)
    srg: SRG-OS-999999
    stigid: RHEL-06-000032

ocil_clause: 'any account other than root has a UID of 0'

ocil: |-
    To list all password file entries for accounts with UID 0, run the following command:
    <pre>$ awk -F: '($3 == 0) {print}' /etc/passwd</pre>
    This should print only one line, for the user root.
