← Back to Red Hat Enterprise Linux 10 Security Technical Implementation Guide

V-281192

CAT II (Medium)

RHEL 10 must allow only the root account to have unrestricted access to the system.

Rule ID

SV-281192r1166528_rule

STIG

Red Hat Enterprise Linux 10 Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000213

Discussion

An account has root authority if it has a user identifier (UID) of "0". Multiple accounts with a UID of "0" afford more opportunity for potential intruders to guess a password for a privileged account. Proper configuration of sudo is recommended to afford multiple system administrators access to root privileges in an accountable manner.

Check Content

Verify RHEL 10 is configured so that only the "root" account has a UID "0" assignment with the following command:

$ awk -F: '$3 == 0 {print $1}' /etc/passwd
root

If any accounts other than "root" have a UID of "0", this is a finding.

Fix Text

Configure RHEL 10 so that only the "root" account has a UID assignment of "0".

Change the UID of any account on the system, other than "root", that has a UID of "0".

If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.