13

When you setup a new Ubuntu or OS X installation a user is generally created for you. On OS X it is whatever username you pick. On Ubuntu (the server version) usually the ubuntu user is created.

The way I understand it, there is also a root user, which you can access via something like sudo su - root, and entering the password of the ubuntu or the user you created, which is part of the administrators group. Once you switch to root I think you can use the passwd command and change root's password.

But what was root's password before that? Does it exist? Is it a random string of numbers and letters? How does the system deal with that?

3
  • 1
    On Ubuntu, you only need sudo su. The root account is assumed by default. Dec 3, 2011 at 20:10
  • 1
    On Ubuntu, su is only needed for switching to some non-root user. To run a single command as root, type sudo command. To get a root shell, type sudo -i. Dec 6, 2011 at 0:00
  • And if you tell someone on the ubuntu forums how to set a root password, or boot and reset a user password via a livecd, it can get your account banninated for 30 days... ask me how I know.... The Ubuntu folks really don't want you having a password set for root, they want you to always use sudo
    – ivanivan
    Oct 21, 2017 at 15:09

6 Answers 6

12

I can answer only for Ubuntu.
In Ubuntu the root user has a locked password. From passwd man page:

   -l, --lock
           Lock the password of the named account. This option disables a 
           password by changing it to a value which matches no possible 
           encrypted value (it adds a '!' at the beginning of the password).

You can see the ! in /etc/shadow.

A user with a locked account cannot change its password, but root can, without prior entering of the old password.

11

Here's how to unlock (?) or create an actual root user in OSX:

  1. System preferences
  2. Users & Groups
  3. Login options (click lock and authenticate here)
  4. Click "Join" (NAS)
  5. Open Directory Utility
  6. Click the lock (authenticate again)
  7. Edit menu -> enable root user
  8. (Edit menu -> change root password)

Enjoy !

3
  • +1 for the good description of the Mac GUI. I only ever knew the command line way to activate the root account. Dec 4, 2011 at 9:25
  • Yeah, I was amazed when the Apple Customer Care guy walked me through the steps to do this...I figured it's too good of a secret to keep "hidden". Dec 4, 2011 at 19:28
  • See support.apple.com/kb/HT204012 for the official doc on this.
    – Michael Ma
    Jul 18, 2021 at 14:45
7

As enzotib said, Ubuntu has a root account but it's locked by default.

Now, about Macs:

As you can probably guess, root (along with all the daemon accounts) doesn't appear in the "Users & Groups" section of Settings.

Looking at my mac's /etc/passwd, there is an entry for root, along with a message

Note that this file is consulted directly only when the system is running
in single-user mode.  At other times this information is provided by 
Open Directory.

I tried to find the Open Directory user list, without success, but in the configurations there were mentions of explicitly giving root permissions even though they're implied. I was never prompted for a root password when I first set the machine up, so I'd guess the root account is locked as it is in ubuntu. I didn't (and don't really want to) try giving root a password and logging in with it, but you probably could.

The passwd line:

root:*:0:0:System Administrator:/var/root:/bin/sh

The perl command from keith's comment adds a :0 to the end. No password hash. There's no shadow file I can find either, I haven't been able to find them anywhere to check whether root might have a password.

6
  • What is the output of perl -e 'print join(":", getpwuid(0)), "\n"' ? (NOTE: If it includes something that looks like a hashed password, don't post it here.) Dec 3, 2011 at 22:54
  • @KeithThompson Posted it, nothing special. I know about the hash, but I appreciate you including the warning for users who might not.
    – Kevin
    Dec 3, 2011 at 23:24
  • 1
    What about the same Perl command with your own uid? Does that show a hashed password? (Again, obviously, don't post the hash.) Dec 3, 2011 at 23:32
  • 1
    Hmm. Perhaps getpwuid() on MacOS does that deliberately, to avoid revealing sensitive information (though there has to be something that can access the hashed password). Dec 3, 2011 at 23:39
  • 1
    I've been searching online and it seems they had a shadow in the last os but I can't find one in lion.
    – Kevin
    Dec 3, 2011 at 23:53
7

The root password on Mac OS X is stored (as mentioned by Kevin) in Open Directory. To confirm the existence of the root user a simple grep is required:

$ grep ^root /etc/passwd 
root:*:0:0:System Administrator:/var/root:/bin/sh

To read the root password information from Open Directory:

$ dscl localhost -read /Local/Default/Users/root Password
Password: *
$ dscl localhost -read /Local/Default/Users/root AuthenticationAuthority
No such key: AuthenticationAuthority

In the default case (as shown), the root user does not have a password hash set (the account is locked). You can compare this setting with the value in OD for a "normal" user:

$ dscl localhost -read /Local/Default/Users/normaluser Password
Password: ********
$ dscl localhost -read /Local/Default/Users/normaluser AuthenticationAuthority
AuthenticationAuthority: ;ShadowHash;HASHLIST:<SALTED-SHA512>...#rest of hash data
2

Ubuntu sets up a password for the named user and uses it for superuser (root) level tasks as installing and deleting system wide software and directory and file deletion/execution beyond your home directory. A root account is in fact in place but without an assigned password a bit hidden. Canonical, and Ubuntu usage conventions, in effect discourage you from directly invoking it.

It sets up a named user account rather than setting up a generic "ubuntu" account. That is at least the case with installed systems. A generic "ubuntu" account maybe in place if you use a live CD, I can't remember, I have not worked with a live CD in a couple of years.

The behavior in MacOsX is actually quite similar. You are asked to set a password, which is invoked each time you attempt to do superuser level tasks such as installing or upgrading software but there is no account named "root".

3
  • 3
    I believe there in fact a root "user". You can su to root, root has a home directory, and files can be owned by root. Can you provide some citation to your argument that there is no root account?
    – cwd
    Dec 3, 2011 at 22:56
  • 3
    Certainly there's an explicit root account (uid 0, name "root"). There has to be on any Unix-like system. It just doesn't have a password (at least by default). You can even get a root shell: sudo bash -l, then type whoami. (But normally you should use sudo for individual commands rather than having an interactive shell running as root.) Dec 3, 2011 at 22:57
  • You maybe correct, I am not questioning you. If there is a root account, then they have done a good job hiding it. I also use Fedora on some of my machines and VMs and root is very much an active account.
    – haziz
    Dec 3, 2011 at 23:06
1

For Ubuntu: by default you can access your newly created user account.

To run any command as root you can use

sudo command

then enter your normal password.

The root account is by default locked. To activate root by command line just enter

sudo passwd

then enter your logged in user's password and then new passwords for root. Now you can log in as root using su and then enter root's password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .