↑ ↓ select, Enter open, Esc close

Find accounts with UID 0 and root privileges

user@server
awk -F: '$3 == 0 {print $1}' /etc/passwd

Prints all usernames from /etc/passwd whose UID is 0. Each of these accounts has full root privileges, regardless of its name. On a clean system, only root appears here.

Note: Any other match should be investigated immediately, attackers like to create accounts with inconspicuous names and UID 0.

Also searched as

  • find users with uid 0
  • check for hidden root accounts
  • linux backdoor root user

Related one-liners

All in Security

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.