# Ensure root is the only GID 0 account

Necessity: The Group ID (GID) of 0 is reserved for the 'root' group, which traditionally has superuser-level access permissions to system files and directories. Assigning GID 0 to any account other than 'root' grants that account extensive permissions, creating a significant security vulnerability. This misconfiguration can lead to unauthorized privilege escalation, allowing a non-root user to read, modify, or execute critical system files, potentially leading to a full system compromise.

Auditing and Remediation: The audit script examines the fourth field of each line in the '/etc/passwd' file, which corresponds to the user's primary GID. It reports any username found with a GID of 0. The remediation script takes a non-compliant username as input and alters its primary GID to a non-privileged value, thereby revoking the excessive permissions and enforcing the principle of least privilege.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is identical: only the 'root' account should have GID 0. This is a fundamental, non-negotiable security principle in Unix-like systems. There is no acceptable scenario for a 'basic' or less secure configuration. Any deviation from this standard introduces a critical risk by granting root-level permissions to accounts that should not have them, violating the principle of least privilege.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that parses the '/etc/passwd' file to find all user accounts with a Group ID (GID) of 0. The script must output only the usernames, one per line, with no additional text or formatting.

## Remediation Script Working

shell script that accepts a single username as a positional command-line argument. The script should change the primary GID of this user to a new, unique, non-zero GID. A reliable method is to create a new group named after the user and assign the user to it. The script must output 'true' on success and 'false' on failure.

