Bash

In Linux, user identity and permissions are determined strictly by numerical User IDs (UIDs), not usernames. If multiple user accounts share the same UID, they possess identical access rights across the file system. Attackers who compromise a system sometimes create a secondary account (e.g., guest or support) with UID 0 to maintain stealthy root access without alerting administrators reviewing login usernames. Finding Duplicate UIDs To inspect all local and directory accounts (including LDAP/NIS/SSSD if configured), query getent passwd: ...