Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 9 down vote favorite
5

On a linux box, how do I list all users that have root priveleges (and even better, all users in general along with if they have root or not)?

share|improve this question
Can you be more specific as to what you mean by "root privileges"? You mean users with UID=0? – Chris S♦ Dec 2 '10 at 14:36
Users having the ability to do anything. Basically - I need to list users along with the groups they are members of if it is possible. – Eric Dec 2 '10 at 14:39
1  
If I knew where your computer was, I could walk up and pull the power cord. That would qualify as "do anything" which means I'm on your list. Rafiq has listed the three most common things, but there could be more and we know noting about your system or how it's setup. – Chris S♦ Dec 2 '10 at 14:46

4 Answers

up vote 9 down vote accepted

Don't forget to change the root password. If any user has UID 0 besides root, they shouldn't. Bad idea. To check:

grep 'x:0:' /etc/passwd

Again, you shouldn't do this but to check if the user is a member of the root group:

grep root /etc/group

To see if anyone can execute commands as root, check sudoers:

cat /etc/sudoers

To check for SUID bit, which allows programs to be executed with root privileges:

find / -perm -04000

share|improve this answer
Strictly, that first one only works if the shadow password file is in user. I agree that it nearly always is, these days, but just in case, I did a quick perl job that explicitly checks field 3. – MadHatter Dec 2 '10 at 14:45
2  
This is a better pattern than the first one: grep '[^:]*:[^:]*:0:' /etc/passwd. +1 in particular for checking for SUID. – Dennis Williamson Dec 2 '10 at 15:19
up vote 6 down vote

To see who is UID 0:

getent passwd 0

To see who is in groups root, wheel adm and admin:

getent group root wheel adm admin

To list all users and the groups they are members of:

getent passwd | cut -d : -f 1 | xargs groups
share|improve this answer
Unlike all other answers which wrongly rely on the /etc/passwd file, this one, using getent passwd instead, is actually correct. Just don't forget to check /etc/sudoers. – mivk Jun 9 '12 at 16:02
up vote 3 down vote

Pure root is user id "0".

All the users in the system are in the /etc/passwd file:

less /etc/passwd

Those who are root have "0" as the user id, which is the 3rd column. Those with "0" as the group (4th column) may also have some root privileges.

Next, you'll want to look at the groups, and see who is an additional member of the "root" or "wheel" or "admin" groups:

less /etc/group

Users listed in those groups could have some root privileges, especially via the "sudo" command.

The final thing you will want to check is the "sudo" config and see who is listed as having authorisation to run this command. This file itself is well documented so I won't reproduce it here:

less /etc/sudoers

That covers the main areas of who could have root access.

share|improve this answer
See also serverfault.com/questions/205598/… for a few more places where privilege-escalation rights could be granted. (Namely, consolehelper and PackageKit.) – mattdm Dec 2 '10 at 15:18
All users are definitely NOT guaranteed to be in /etc/passwd. They may be in LDAP, for example. But getent passwd should list all system users (including root), in passwd format, regardless of the database where they are defined. – mivk Jun 9 '12 at 15:57
up vote 2 down vote

To print all users

perl -n -e '@user = split /:/ ; print "@user[0]\n";' < /etc/passwd

To print only those users with UID 0, being as others have said, the users with implicit root privileges:

perl -n -e '@user = split /:/ ; print "@user[0]\n" if @user[2] == "0";' < /etc/passwd
share|improve this answer
That's a good one liner, but be aware of the limitations (I'm sure MadHatter is aware of this already) - it won't check groups and it won't check sudoers. It will only check, as he says, implicit root. – Rafiq Maniar Dec 2 '10 at 14:54
Don't parse /etc/passwd. Users may be defined elsewhere. Use getent passwd instead. For your first "print all users" example, rather try this: getent passwd | perl -naF: -e 'print "$F[0]\n"' – mivk Jun 9 '12 at 16:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.