SLEM 5 root account must be the only account with unrestricted access to the system.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| high | V-261359 | SRG-OS-000480-GPOS-00227 | SLEM-05-411065 | SV-261359r996526_rule | 2024-06-04 | 1 |
| Description |
|---|
| If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that account unrestricted access to the entire SLEM 5. Multiple accounts with a UID of "0" afford an opportunity for potential intruders to guess a password for a privileged account. |
| ℹ️ Check |
|---|
| Verify that SLEM 5 root account is the only account with unrestricted access to the system with the following command: > awk -F: '$3 == 0 {print $1}' /etc/passwd root If any accounts other than root are listed, this is a finding. |
| ✔️ Fix |
|---|
| Change the UID of any account on SLEM 5, other than the root account, that has a UID of "0". If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". If the account is not associated with system commands or applications, assign a UID of greater than "1000" that has not already been assigned. |