A hacker would not benefit from adding duplicate entries like this and if a hacker had gained sudo
access to your system, this issue would be the least of your concerns. So rest assured.
One probability
getent
will get entries from Name Service Switch libraries:
The getent command displays entries from databases supported by the
Name Service Switch libraries, which are configured in
/etc/nsswitch.conf. If one or more key arguments are provided, then
only the entries that match the supplied keys will be displayed.
Otherwise, if no key is provided, all entries will be displayed
(unless the database does not support enumeration).
So yes getent
will query whatever database reachable from /etc/nsswitch.conf
including /etc/passwd
and /etc/group
referred to by files
as well as probably LDAP
and other services referred to by systemd
( provided through systemd's Varlink and nss-systemd ) and show all the results from all databases.
It is worth mentioning that the nss-systemd module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs 0 and 65534) remain resolvable at all times, even if they aren't listed
in /etc/passwd or /etc/group, or if these files are missing.
Another probability
Another explanation is simply that you have two entries for the same user with different user shells in the password file /etc/passwd
:
root:x:0:0:root:/root:/bin/bash
root:x:0:0:root:/root:/bin/sh
And two duplicate identical entries in the user group file /etc/group
:
root:x:0:
root:x:0:
Duplicate entries are not normal but can happen... for example due to trying to change the user shell by following some guide on the Internet and copy paste while a similar entry is already existent ( very possible with common user names like root ) or it can be added by running scripts that modify /etc/passwd
and /etc/group
with sudo
privilege.
While your system might work normally with duplicate entries in /etc/passwd
and /etc/group
ie. reading the first entry and ignoring the duplicates, it is better to remove duplicate lines ( please read about it first and make sure you back the files up before fixing and use vipw / vigr for editing ).
grep root /etc/passwd
? If there are two entries in thepasswd
file, you can delete the one that contains/bin/sh
using the commandsudo vipw
.