# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-AUTH-016
title: Keep root the only superuser account and protect its password
finding:
  title: Another account has superuser identity, or root has no password protection
  description: A second UID 0 account is a hidden root backdoor; a root account with an empty password needs no secret.
status: active
profiles: [core]
risk:
  severity: high
assessment: automated
tags: [accounts, root]

description: |
  The kernel grants full privileges to UID 0, whatever the account name. Group ID 0 grants
  access to every file owned by the `root` group. This control checks that:

  - `root` is the only account with UID 0 and the only one with primary GID 0;
  - `root` is the only group with GID 0;
  - the `root` account either has a password or is locked (`passwd -S root` shows `P` or `L`).
rationale: |
  Attackers who gain root often add a second UID 0 account under an innocent name to keep
  access. A root account without any password, or with an empty one, can be used by anyone who
  reaches a login prompt.
impact: |
  None for a standard system.
notes: |
  Debian cloud images lock root (`L`); an installation with a root password shows `P`. Both are fine.

audit:
  manual: |
    1. `awk -F: '$3 == 0' /etc/passwd` lists only `root`.
    2. `awk -F: '$4 == 0' /etc/passwd` lists only `root` (and `sync`, `shutdown`, `halt` if present).
    3. `awk -F: '$3 == 0' /etc/group` lists only `root`.
    4. `passwd -S root` shows `P` or `L` in the second field.
  checks:
    - id: uid0
      engine: shell
      spec:
        script: |
          u=$(awk -F: '$3 == 0 {print $1}' /etc/passwd | tr '\n' ' ')
          echo "UID 0: $u"
          [ "$u" = "root " ]
    - id: gid0
      engine: shell
      spec:
        script: |
          u=$(awk -F: '$4 == 0 && $1 !~ /^(root|sync|shutdown|halt|operator)$/ {print $1}' /etc/passwd | tr '\n' ' ')
          g=$(awk -F: '$3 == 0 {print $1}' /etc/group | tr '\n' ' ')
          echo "other users with GID 0: ${u:-none}; groups with GID 0: $g"
          [ -z "$u" ] && [ "$g" = "root " ]
    - id: root-password
      engine: shell
      spec:
        script: |
          s=$(passwd -S root | cut -d' ' -f2)
          echo "root status: $s"
          [ "$s" = P ] || [ "$s" = L ]

remediation:
  manual: |
    1. Investigate any other UID 0 or GID 0 account: it may be a backdoor. Remove it with
       `userdel`, or give it its own IDs with `usermod -u` and `usermod -g`.
    2. Set a strong root password with `passwd root`, or lock it with `passwd -l root` if
       administrators use sudo.

references:
  - title: passwd(5), Debian manual pages
    url: https://manpages.debian.org/trixie/passwd/passwd.5.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: passwd(1), Debian manual pages
    url: https://manpages.debian.org/trixie/passwd/passwd.1.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6(5)
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.1"
    relation: equivalent
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.2"
    relation: equivalent
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.3"
    relation: equivalent
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "5.4.2.4"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.1"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.2"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.3"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "5.4.2.4"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1136.001
  - framework: mitre-attack
    id: T1078.003

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: Generated check, fix and check again for profiles core and server-hardened; state kept after reboot.
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18