A hacker would not benefit from adding duplicate entries like this and if a hacker had gained
sudo access to your system, this issue would be the least of your concerns. So rest assured.
getent will get entries from Name Service Switch libraries:
The getent command displays entries from databases supported by the
Name Service Switch libraries, which are configured in
/etc/nsswitch.conf. If one or more key arguments are provided, then
only the entries that match the supplied keys will be displayed.
Otherwise, if no key is provided, all entries will be displayed
(unless the database does not support enumeration).
getent will query whatever database reachable from
/etc/group referred to by
files as well as probably
LDAP and other services referred to by
systemd ( provided through systemd's Varlink and nss-systemd ) and show all the results from all databases.
It is worth mentioning that the nss-systemd module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs 0 and 65534) remain resolvable at all times, even if they aren't listed
in /etc/passwd or /etc/group, or if these files are missing.
Another explanation is simply that you have two entries for the same user with different user shells in the password file
And two duplicate identical entries in the user group file
Duplicate entries are not normal but can happen... for example due to trying to change the user shell by following some guide on the Internet and copy paste while a similar entry is already existent ( very possible with common user names like root ) or it can be added by running scripts that modify
While your system might work normally with duplicate entries in
/etc/group ie. reading the first entry and ignoring the duplicates, it is better to remove duplicate lines ( please read about it first and make sure you back the files up before fixing and use vipw / vigr for editing ).