Verify Only Root Has UID 0
Ensures root is the only account with UID 0 in /etc/passwd.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
An account has full root authority whenever its UID is 0, regardless of its name. A second UID-0 account is a hidden backdoor: it grants total control, multiplies the password-guessing surface for privileged access, and breaks accountability because actions cannot be tied to a single administrator. Multiple admins should instead share root access through sudo, which is logged per-user.
What Pavois checks
Pavois runs an awk query over /etc/passwd and lists every account whose UID is 0 but whose name is not root. The check passes only when that list is empty. Reading the resolved account database (rather than trusting a name) catches a renamed or duplicate superuser that a casual grep root would miss.
describe command('awk -F: \'($3==0 && $1!="root"){print $1}\' /etc/passwd') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run awk -F: '($3==0 && $1!="root"){print $1}' /etc/passwd. Expected output: nothing (an empty result). Any printed username is an extra UID-0 account that must be removed or re-assigned a non-zero UID.
Inspect & investigate
- List all UID-0 accounts:
awk -F: '$3==0{print $1}' /etc/passwd - Inspect a suspect account:
getent passwd <name> - Privileged-access events appear in
/var/log/auth.log(Debian/Ubuntu) or/var/log/secure(RHEL family).
Remediation
No automated remediation is shipped: removing or re-numbering a UID-0 account is too destructive to apply blindly. Fix it manually, delete the rogue account (userdel) or assign it a unique non-zero UID with usermod -u <newuid> and re-own its files, then re-run the scan.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # List accounts with uid 0 other than root; remove/fix each ONLY after confirming it is rogue. awk -F: '($3==0 && $1!="root"){print $1}' /etc/passwd # for a confirmed rogue account: userdel <name> (irreversible, verify it is not legitimate) |
|---|---|
| reason | deleting an account is irreversible, a human must confirm it is rogue |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A second UID-0 account is equivalent to an undetected root backdoor: full system compromise and loss of audit accountability. Before remediating, confirm the account is not a legitimate, documented service identity; back up /etc/passwd, /etc/shadow and /etc/group; and ensure at least one working root-capable login remains so you do not lock yourself out.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.2.1, 8.2.1 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.1, AC-6(5), IA-2, IA-4(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.2.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.