Quick answer

UID 0 is the numeric user ID of root. Linux grants full privileges based on the UID being 0, not on the username. So any account whose UID is 0 — regardless of its name — is effectively root. An unexpected second UID 0 account is a classic backdoor and a red flag.

What is UID 0?#

Linux identifies users by a numeric UID. The kernel's privilege checks key on UID 0: whoever has it bypasses normal permission checks. The name “root” is just convention; a user called backup2 with UID 0 has the same power.

Group ID 0 (root group) is related but weaker — group membership grants access only where the root group is given it.

Why LinPEAS checks uid 0#

LinPEAS lists all accounts and specifically flags any with UID 0 beyond root. It also enumerates group memberships, because certain groups (docker, lxd, disk, shadow, sudo) can be leveraged toward root.

What a normal configuration looks like#

On a normal system there is exactly one UID 0 account: root. Service accounts have their own non-zero UIDs. Human users typically start at UID 1000.

Why it can be security-sensitive#

A second UID 0 account means someone (or something) has a persistent root-equivalent login. It may be a misconfiguration, a leftover, or a deliberate backdoor. Either way it is one of the highest-priority findings.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

List every UID 0 account
awk -F: '($3==0){print $1}' /etc/passwd
Show your own IDs and groups
id
List all users and their UIDs
cut -d: -f1,3 /etc/passwd

Defensive remediation#

  • Ensure only root has UID 0. Remove or fix any other UID 0 account.
  • Investigate how an extra UID 0 account was created — it may indicate compromise.
  • Restrict membership of powerful groups (docker, lxd, disk, sudo) to those who need it.
  • Use sudo for delegated admin instead of shared root accounts.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496