Two root accounts, one name
Searching the account file for the word root returns a single line, which looks like confirmation that only one account has full privilege. It is not. On Linux privilege comes from the numeric user id, not the name, and any account carrying id 0 is root as far as the kernel is concerned. Filtering on the third field instead of the name reveals a second entry that the name search never showed, and asking the system to resolve it returns uid=0(root). A normal service account such as daemon returns uid=1 and stays there. An extra id 0 account is one of the quietest persistence mechanisms there is, because every name-based check walks straight past it - so audit the id field, not the label.
There are two root accounts on this machine. Only one of them is called root.
You check who can become root by looking for the name. That is not what the system checks.
Search the account file for the word root and you get a single line, exactly what you expect.
But the name means nothing here. Privilege comes from the user id, and the id that matters is zero. Filter on that field instead and a second account appears, one that was never in the first result.
Ask the system what that name resolves to, and it answers with zero, and with the word root.
A normal service account looks nothing like it. Its id is one, and it stays one. The second account is not a copy of root. As far as the kernel is concerned, it is root.
Filter your account file on the id field, not the name.
#linux#security#selfhosted#infosec#sysadmin
❯ Filter your account file on the id field, not the name.