# Ensure root is the only UID 0 account

Necessity: The User ID (UID) of 0 is reserved for the 'root' account, which possesses superuser privileges and unrestricted access to the entire system. Granting UID 0 to any other account creates a backdoor with the same absolute power as root. This significantly increases the attack surface, complicates auditing (as actions from multiple UID 0 accounts are logged ambiguously), and often indicates a system compromise. The primary risk is unauthorized, unaudited, and complete control over the operating system.

Auditing and Remediation: The audit script systematically parses the '/etc/passwd' file, checking the third field (UID) of each user entry. It counts every instance where the UID is 0 but the username (the first field) is not 'root'. The remediation script is designed for containment rather than destructive changes; it identifies these illegitimate superuser accounts and locks them to prevent interactive login, flagging them for manual administrative investigation and resolution.

Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is an uncompromising '0'. This is a binary security control; there is no acceptable scenario in a hardened system for a non-root account to have UID 0. Any value other than zero represents a critical security vulnerability. This configuration enforces the principle of least privilege and ensures that the single, well-known 'root' account is the only one with ultimate administrative authority, which is a foundational requirement in security standards like the CIS Benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the '/etc/passwd' file to count the number of user accounts with a UID of 0 that are not named 'root'. The script must return only the resulting integer count, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single argument: the target count of non-root UID 0 accounts, which must be '0'. The script should identify all accounts with UID 0 other than 'root'. It should then log these accounts to a security log file for administrative review and attempt to lock them by setting their shell to '/sbin/nologin' or an equivalent non-interactive shell. Since automatic deletion or UID change is a high-risk operation, this script focuses on containment. It must return 'true' if no unauthorized UID 0 accounts are found or if they are successfully locked, and 'false' if an error occurs.

