3

In Ubuntu 20.04 i have two root record when i do:

getent passwd| grep root

i got

root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh

and when I use

getent group| grep root

I got

root:x:0:
root:x:0:

Do I understand correctly that, this is due to the fact that this machine has an LDAP server and nsswitch.conf contains:

passwd: files systemd group: files systemd

And is it enough to remove "systemd" to remove this anamaly And the presence of two "root" does not mean hacking the system?

Note after clarifying questions "FedonKadifeli" and "Raffa":

There is only one "root" entry in the /etc/passwd and /etc/group files. I did an experiment, removed the "systemd" entry in the /etc/nsswitch.conf file, leaving:

passwd: files 
group: files

and get one record for getent passwd| grep root:

root:x:0:0:root:/root:/bin/bash

and one record for getent group| grep root:

root:x:0:0

2
  • What is the output of grep root /etc/passwd? If there are two entries in the passwd file, you can delete the one that contains /bin/sh using the command sudo vipw. – FedonKadifeli May 7 at 18:35
  • Mess with this stuff and you're going to break your system. – heynnema May 7 at 19:24
3

A hacker would not benefit from adding duplicate entries like this and if a hacker had gained sudo access to your system, this issue would be the least of your concerns. So rest assured.

One probability

getent will get entries from Name Service Switch libraries:

The getent command displays entries from databases supported by the Name Service Switch libraries, which are configured in /etc/nsswitch.conf. If one or more key arguments are provided, then only the entries that match the supplied keys will be displayed. Otherwise, if no key is provided, all entries will be displayed (unless the database does not support enumeration).

So yes getent will query whatever database reachable from /etc/nsswitch.conf including /etc/passwd and /etc/group referred to by files as well as probably LDAP and other services referred to by systemd ( provided through systemd's Varlink and nss-systemd ) and show all the results from all databases.

It is worth mentioning that the nss-systemd module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs 0 and 65534) remain resolvable at all times, even if they aren't listed in /etc/passwd or /etc/group, or if these files are missing.

Another probability

Another explanation is simply that you have two entries for the same user with different user shells in the password file /etc/passwd:

root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh

And two duplicate identical entries in the user group file /etc/group:

root:x:0:
root:x:0:

Duplicate entries are not normal but can happen... for example due to trying to change the user shell by following some guide on the Internet and copy paste while a similar entry is already existent ( very possible with common user names like root ) or it can be added by running scripts that modify /etc/passwd and /etc/group with sudo privilege.

While your system might work normally with duplicate entries in /etc/passwd and /etc/group ie. reading the first entry and ignoring the duplicates, it is better to remove duplicate lines ( please read about it first and make sure you back the files up before fixing and use vipw / vigr for editing ).

2
  • I'm sorry, but you're wrong. There is only one root entry in the / etc / passwd and / etc / group files. I did an experiment, removed the systemd entry in the /etc/nsswitch.conf file, leaving: ` passwd: files systemd group: files systemd ` and get one record for getent passwd| grep root: root:x:0:0:root:/root:/bin/bash and one record for getent group| grep root: root:x:0:0 – s79 May 8 at 0:41
  • @s79 Apologies... missed the getent part at the first time... You are very right and answer updated. – Raffa May 8 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.