Description
If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
If the account is associated with system commands or applications the UID
should be changed to one greater than "0" but less than "1000."
Otherwise assign a UID greater than "1000" that has not already been
assigned.
Rationale
An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner.
- ID
xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero
- References
CSC: Critical Security Controls
COBIT®: Control Objectives for Information and Related Technologies
SP 800-171 Rev. 1: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
CCI: Control Correlation Identifier
ISA-62443-2-1-2009, Security for Industrial Automation and Control Systems Part 2-1: Establishing an Industrial Automation and Control Systems Security Program
ANSI/ISA-62443-3-3 (99.03.03)-2013 Security for industrial automation and control systems Part 3-3: System security requirements and security levels
CIP: Critical Infrastructure Protection
NIST Special Publication 800-53 (Revision 4): Security and Privacy Controls for Federal Information Systems and Organizations
Framework for Improving Critical Infrastructure Cybersecurity
PCI DSS v3: Payment Card Industry Data Security Standard
GPOS SRG: General Purpose Operating System Security Requirements Guide
CCE: Common Configuration Enumeration
PCI DSS v4: Payment Card Industry Data Security Standard