documentation_complete: true

title: 'Only Root Has UID 0'

description: 'If any account other than root has a UID of 0, this misconfiguration should be investigated and the accounts other than root should be removed or have their UID changed.'

rationale: |-
    An account has root authority if it has a UID of 0.
    Multiple accounts with a UID of 0 afford greater opportunity for potential intruders to guess or decrypt the password for a privileged account.
    Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

severity: high

references:
    disa: 366
    nist: AC-6,IA-2(1)

ocil_clause: 'any account other than root has a UID of 0'

ocil: |-
    To list all password file entries for accounts with UID 0, run the following command:
    <pre># awk -F: '($3 == "0") {print}' /etc/passwd</pre>
    This should print only one line, for the user root.
