{"description": "If any account other than root has a UID of 0, this misconfiguration should\nbe investigated and the accounts other than root should be removed or have\ntheir UID changed.\n
\nIf the account is associated with system commands or applications the UID\nshould be changed to one greater than \"0\" but less than \"1000.\"\nOtherwise assign a UID greater than \"1000\" that has not already been\nassigned.", "rationale": "An account has root authority if it has a UID of 0. Multiple accounts\nwith a UID of 0 afford more opportunity for potential intruders to\nguess a password for a privileged account. Proper configuration of\nsudo is recommended to afford multiple system administrators\naccess to root privileges in an accountable manner.", "severity": "high", "references": {"cis-csc": ["1", "12", "13", "14", "15", "16", "18", "3", "5"], "cobit5": ["APO01.06", "DSS05.04", "DSS05.05", "DSS05.07", "DSS05.10", "DSS06.02", "DSS06.03", "DSS06.10"], "cui": ["3.1.1", "3.1.5"], "isa-62443-2009": ["4.3.3.2.2", "4.3.3.5.1", "4.3.3.5.2", "4.3.3.6.1", "4.3.3.6.2", "4.3.3.6.3", "4.3.3.6.4", "4.3.3.6.5", "4.3.3.6.6", "4.3.3.6.7", "4.3.3.6.8", "4.3.3.6.9", "4.3.3.7.2", "4.3.3.7.3", "4.3.3.7.4"], "isa-62443-2013": ["SR 1.1", "SR 1.10", "SR 1.2", "SR 1.3", "SR 1.4", "SR 1.5", "SR 1.7", "SR 1.8", "SR 1.9", "SR 2.1", "SR 5.2"], "iso27001-2013": ["A.10.1.1", "A.11.1.4", "A.11.1.5", "A.11.2.1", "A.13.1.1", "A.13.1.3", "A.13.2.1", "A.13.2.3", "A.13.2.4", "A.14.1.2", "A.14.1.3", "A.18.1.4", "A.6.1.2", "A.7.1.1", "A.7.1.2", "A.7.3.1", "A.8.2.2", "A.8.2.3", "A.9.1.1", "A.9.1.2", "A.9.2.1", "A.9.2.2", "A.9.2.3", "A.9.2.4", "A.9.2.6", "A.9.3.1", "A.9.4.1", "A.9.4.2", "A.9.4.3", "A.9.4.4", "A.9.4.5"], "nerc-cip": ["CIP-003-8 R5.1.1", "CIP-003-8 R5.3", "CIP-004-6 R2.2.3", "CIP-004-6 R2.3", "CIP-007-3 R5.1", "CIP-007-3 R5.1.2", "CIP-007-3 R5.2", "CIP-007-3 R5.3.1", "CIP-007-3 R5.3.2", "CIP-007-3 R5.3.3"], "nist": ["IA-2", "AC-6(5)", "IA-4(b)"], "nist-csf": ["PR.AC-1", "PR.AC-4", "PR.AC-6", "PR.AC-7", "PR.DS-5"], "pcidss": ["Req-8.5"], "srg": ["SRG-OS-000480-GPOS-00227"], "cis": ["5.4.2.1"], "ism": ["1546"], "pcidss4": ["8.2.1", "8.2"]}, "control_references": {"cis": ["5.4.2.1"], "ism": ["1546"], "pcidss4": ["8.2.1", "8.2"]}, "components": [], "identifiers": {}, "ocil_clause": "any accounts other than \"root\" have a UID of \"0\"", "ocil": "Verify that only the \"root\" account has a UID \"0\" assignment with the\nfollowing command:\n
$ awk -F: '$3 == 0 {print $1}' /etc/passwd
\n
root
", "oval_external_content": null, "fixtext": "Change the UID of any account on the system, other than root, that has a UID of \"0\".\nIf the account is associated with system commands or applications, the UID\nshould be changed to one greater than \"0\" but less than \"1000\". Otherwise,\nassign a UID of greater than \"1000\" that has not already been assigned.", "checktext": "", "vuldiscussion": "", "srg_requirement": "The root account must be the only account having unrestricted access to the Ubuntu 22.04 system.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "The root account must be the only account having unrestricted access to Ubuntu 22.04 system.", "vuldiscussion": "An account has root authority if it has a user identifier (UID) of \"0\". Multiple accounts with a UID of \"0\" afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.", "checktext": "Verify that only the \"root\" account has a UID \"0\" assignment with the following command:\n\n$ awk -F: '$3 == 0 {print $1}' /etc/passwd\n\nroot\n\nIf any accounts other than \"root\" have a UID of \"0\", this is a finding.", "fixtext": "Change the UID of any account on the system, other than root, that has a UID of \"0\".\n\nIf the account is associated with system commands or applications, the UID should be changed to one greater than \"0\" but less than \"1000\". Otherwise, assign a UID of greater than \"1000\" that has not already been assigned."}}, "platform": "system_with_kernel", "platforms": ["system_with_kernel"], "sce_metadata": {}, "inherited_platforms": [], "cpe_platform_names": ["system_with_kernel"], "inherited_cpe_platform_names": [], "bash_conditional": null, "fixes": {}, "title": "Verify Only Root Has UID 0", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml", "template": null}