On a linux box, how do I list all users that possess identical privilege to the superuser (and even better, all users in general along with if they are able to escalate their privilege to that level or not)?
-
3Can you be more specific as to what you mean by "root privileges"? You mean users with UID=0?– Chris SDec 2, 2010 at 14:36
-
Users having the ability to do anything. Basically - I need to list users along with the groups they are members of if it is possible.– EricDec 2, 2010 at 14:39
-
3If I knew where your computer was, I could walk up and pull the power cord. That would qualify as "do anything" which means I'm on your list. Rafiq has listed the three most common things, but there could be more and we know noting about your system or how it's setup.– Chris SDec 2, 2010 at 14:46
8 Answers
Don't forget to change the root password. If any user has UID 0 besides root, they shouldn't. Bad idea. To check:
grep 'x:0:' /etc/passwd
Again, you shouldn't do this but to check if the user is a member of the root group:
grep root /etc/group
To see if anyone can execute commands as root, check sudoers:
cat /etc/sudoers
To check for SUID bit, which allows programs to be executed with root privileges:
find / -perm -04000
-
Strictly, that first one only works if the shadow password file is in user. I agree that it nearly always is, these days, but just in case, I did a quick perl job that explicitly checks field 3. Dec 2, 2010 at 14:45
-
6This is a better pattern than the first one:
grep '[^:]*:[^:]*:0:' /etc/passwd
. +1 in particular for checking for SUID. Dec 2, 2010 at 15:19 -
-
@bbodenmiller: Because other characters can appear in the password field. Jun 27, 2022 at 12:44
To see who is UID 0:
getent passwd 0
To see who is in groups root
, wheel
adm
and admin
:
getent group root wheel adm admin
To list all users and the groups they are members of:
getent passwd | cut -d : -f 1 | xargs groups
-
13Unlike all other answers which wrongly rely on the /etc/passwd file, this one, using
getent passwd
instead, is actually correct. Just don't forget to check /etc/sudoers.– mivkJun 9, 2012 at 16:02 -
-
Might add
sudo egrep '\(root\)|\(ALL\)' /etc/sudoers; sudo ls /etc/sudoers.d
for sudo Apr 9, 2021 at 3:37
Pure root is user id "0".
All the users in the system are in the /etc/passwd file:
less /etc/passwd
Those who are root have "0" as the user id, which is the 3rd column. Those with "0" as the group (4th column) may also have some root privileges.
Next, you'll want to look at the groups, and see who is an additional member of the "root" or "wheel" or "admin" groups:
less /etc/group
Users listed in those groups could have some root privileges, especially via the "sudo" command.
The final thing you will want to check is the "sudo" config and see who is listed as having authorisation to run this command. This file itself is well documented so I won't reproduce it here:
less /etc/sudoers
That covers the main areas of who could have root access.
-
See also serverfault.com/questions/205598/… for a few more places where privilege-escalation rights could be granted. (Namely,
consolehelper
andPackageKit
.)– mattdmDec 2, 2010 at 15:18 -
2All users are definitely NOT guaranteed to be in /etc/passwd. They may be in LDAP, for example. But
getent passwd
should list all system users (including root), in passwd format, regardless of the database where they are defined.– mivkJun 9, 2012 at 15:57
To print all users
perl -n -e '@user = split /:/ ; print "@user[0]\n";' < /etc/passwd
To print only those users with UID 0, being as others have said, the users with implicit root privileges:
perl -n -e '@user = split /:/ ; print "@user[0]\n" if @user[2] == "0";' < /etc/passwd
-
That's a good one liner, but be aware of the limitations (I'm sure MadHatter is aware of this already) - it won't check groups and it won't check sudoers. It will only check, as he says, implicit root. Dec 2, 2010 at 14:54
-
2Don't parse /etc/passwd. Users may be defined elsewhere. Use
getent passwd
instead. For your first "print all users" example, rather try this:getent passwd | perl -naF: -e 'print "$F[0]\n"'
– mivkJun 9, 2012 at 16:08
For a quick list of all users, try hitting tab twice (to auto-complete) after typing the passwd
command followed by a space. This works with the su
command as well.
Must be done as a root-privileged user.
-
Is this a zsh specific feature? Bash suggests just files on openSUSE.– jgillichSep 16, 2013 at 19:07
-
Tested on Debian (Squeeze) in bash. I don't believe anyone would officially support this, but it's a shortcut.– EmeraldoSep 17, 2013 at 1:55
-
Update: This no longer works in El Capitan. It was probably fixed for security reasons.– EmeraldoApr 24, 2016 at 0:41
It was annoying me that there wasnt a one-liner answer... If you want to list all UID 0 (root) accounts use the following:
cat /etc/passwd | cut -f1,3,4 -d":" | grep"0:0" | cut -f1 -d":" | awk '{print $1}'
Best,
None of the other answers work for enterprise-grade systems with LDAP-based permissions management. Try the following command that works universally on all setups to check whether a user has sudo access:
sudo -l -U $(whoami)
IEEE Std 1003.1-2017 Shell Command Language
ps -jf 1 | tail -n 1 | awk '{print $1}'
provides the name of the superuser across any UNIX-based OS without extra dependencies.
PowerShell
If ([OperatingSystem]::IsLinux() -Eq $True) { Get-Process -IncludeUserName | Sort-Object -Property Id | Select-Object -First 1 -ExpandProperty UserName } ElseIf ([OperatingSystem]::IsWindows() -Eq $True) { Get-WmiObject -Class Win32_SystemAccount | Where-Object {(Get-Variable -Name _ | Select-Object -ExpandProperty Value).SID -Eq "S-1-5-18"} | Select-Object -ExpandProperty Name }
Although this answer provides this ability well, it does not operate via PowerShell, because
The '<' operator is reserved for future use.
and it requires installation of Perl, which is not necessary available, and not available by default on macOS, which may be important.
-
FYI Linux's
procps-ng
'sps -j
output is different compared to FreeBSD'sps
output. yourawk '{print $1}'
might not work. May 29, 2022 at 7:19 -