UID 0
Any Linux account with user ID 0 has exactly the same privileges as root, regardless of its username. Extra accounts with UID 0 are a common way attackers create a hidden backdoor admin account.
Why the username does not matter
Linux does not check for the literal string "root" to grant root privileges; it checks whether the account's user ID is 0. Anyone who creates a second account with UID 0, under any name, has created a second root account with identical power.
Why this matters during an audit
A file integrity or user audit that only searches for accounts literally named "root" will miss a renamed or duplicated UID 0 account entirely, which is exactly the kind of persistence mechanism an attacker with prior root access might leave behind.
Frequently asked questions
How do I check for extra UID 0 accounts?
Inspect /etc/passwd directly and look at the third field of every line, which is the UID, rather than trusting account names alone.
Is it ever legitimate to have two UID 0 accounts?
In practice, no. Any second account sharing UID 0 should be treated as suspicious until proven otherwise.
Does removing sudo access remove root privileges from a UID 0 account?
No. Sudo is a separate, additional mechanism for granting root privileges temporarily; an account with UID 0 already has full privileges regardless of sudo configuration.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab