Detections
Analytics

5.4.2.1 Ensure root is the only UID 0 account

Information

On a Linux system, the user ID (UID) 0 is the superuser identity: the kernel grants any account assigned UID 0 complete, unrestricted control of the host, regardless of the account's name. The root account holds UID 0 by default.

Limiting UID 0 to the single default root account ensures privileged access is accountable and cannot be silently obtained through a second, easily overlooked superuser identity. Administrative access should be performed through an unprivileged account using an approved escalation mechanism, as described in the recommendation covering restriction of the su command.

Solution

- Run the following command to reassign any account other than root that has UID 0 to a new, unused UID (and update ownership of that account's files):

# usermod -u <NEW_UID> <username>

Example:

# usermod -u 1234 bsmith

 - If the root account's UID is not 0, run the following command to reset it:

# usermod -u 0 root

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT

References: 800-53|AC-6(2), 800-53|AC-6(5), 800-53|CM-6b., CSCv7|4.3

Plugin: Unix

Control ID: e599596071797e2f1310535d01cc8601a670e8064f2daf850132108357c3789b