Cybersecurity

Hello,
I created a new user "rootNew"
After creation I manually change the file /etc/passwd and gave the new user "rootNew" uid 0.
Now I have 2 users with uid 0 (root,rootNew) how can I know which user is log in the system?
"whoami" command return "root" for both users.
Thanks,
Uri

And this is how it will stay. For internal use, the system will refer to the uid only. Just when it needs to output sth, it will translate the uid to THE username by /etc/passwd, and stop on the first match.

So there is no way to know which user has login the system?

If you give them a different home directory or default shell, you can set some specific code in their profile to differentiate the users.

Those user configuration are not under my control.
This is part of a feather for our customers.
So I need to try figure it out without the control on the user configuration.
Thanks.

You should not have more users with UID anything. This is a red flag in any security audit/control. This is 2013 - no excuses.

FYI: the commands lookup username based on userid - the number, not the name - and the first one found, whether it comes from files, ldap, nis, etc. will be the name a command lists. Only way around this would be to replace the standard system libraries with customized libraries that do lookups based on username.

Would still fail a security audit imho.

In short, these days an unacceptable situation. I recommend you make sure your users know they may be breaking the law and/or instructional compliance requirements - as there is no accountability.
If you have a security department - get their support to have this banned on company servers.

Thanks for the response.
You are correct this is a security problem and this exactly what I want to find.
In case there is a hack I want to catch it.