Keep root the only superuser account and protect its password

Description

The kernel grants full privileges to UID 0, whatever the account name. Group ID 0 grants access to every file owned by the root group. This control checks that:

• root is the only account with UID 0 and the only one with primary GID 0;
• root is the only group with GID 0;
• the root account either has a password or is locked (passwd -S root shows P or L).

Debian cloud images lock root (L); an installation with a root password shows P. Both are fine.

Rationale

Attackers who gain root often add a second UID 0 account under an innocent name to keep access. A root account without any password, or with an empty one, can be used by anyone who reaches a login prompt.

Impact

None for a standard system.

Audit

1. awk -F: '$3 == 0' /etc/passwd lists only root.
2. awk -F: '$4 == 0' /etc/passwd lists only root (and sync, shutdown, halt if present).
3. awk -F: '$3 == 0' /etc/group lists only root.
4. passwd -S root shows P or L in the second field.

Automated: every check must pass. Scanners report each check by its id.

uid0

script: |
  u=$(awk -F: '$3 == 0 {print $1}' /etc/passwd | tr '\n' ' ')
  echo "UID 0: $u"
  [ "$u" = "root " ]

gid0

script: |
  u=$(awk -F: '$4 == 0 && $1 !~ /^(root|sync|shutdown|halt|operator)$/ {print $1}' /etc/passwd | tr '\n' ' ')
  g=$(awk -F: '$3 == 0 {print $1}' /etc/group | tr '\n' ' ')
  echo "other users with GID 0: ${u:-none}; groups with GID 0: $g"
  [ -z "$u" ] && [ "$g" = "root " ]

root-password

script: |
  s=$(passwd -S root | cut -d' ' -f2)
  echo "root status: $s"
  [ "$s" = P ] || [ "$s" = L ]

Remediation

1. Investigate any other UID 0 or GID 0 account: it may be a backdoor. Remove it with userdel, or give it its own IDs with usermod -u and usermod -g.
2. Set a strong root password with passwd root, or lock it with passwd -l root if administrators use sudo.

References

• passwd(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• passwd(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle