# Ensure root is the only UID 0 account

Necessity: An account with a User ID (UID) of 0 is a 'root' or 'superuser' account, possessing complete and unrestricted access to the system. Allowing multiple accounts to have UID 0 significantly increases the attack surface, as compromising any of them grants an attacker full control. It also complicates auditing and accountability, making it difficult to trace administrative actions back to a specific individual. The primary risk of misconfiguration is the existence of unauthorized or forgotten root-level accounts that can be exploited.

Auditing and Remediation: The audit script systematically checks the user database file (/etc/passwd) to identify and list all accounts with UID 0. The remediation script takes corrective action by finding any UID 0 accounts other than the designated 'root' account and locking them. Locking an account prevents it from being used for login, effectively neutralizing the immediate security threat pending further administrative review.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is identical because there is only one secure configuration for this setting. The principle of least privilege and standard security benchmarks (like CIS) mandate that only the single, default 'root' account should have UID 0. There is no acceptable scenario in a hardened environment for having multiple superuser accounts; therefore, the recommended state does not vary across different security levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the /etc/passwd file and returns a newline-separated list of all usernames that have a User ID (UID) of 0. The output must contain only the usernames and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the username of the only account that is permitted to have UID 0 (e.g., 'root'). The script must find any other accounts with UID 0, lock their passwords using 'passwd -l', and log the action. The script must return 'true' if the system is compliant or was successfully brought into compliance, and 'false' on failure.

