Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize):

  1. sudo -i eliminates the need for a password. Isn't that a problem for security reasons?
  2. there are conflicting views on whether to change the password from its original hash value:

By default the root user is setup with a random hash during the install of Ubuntu

If one should use the original hash value, I have no idea what mine is. How do I retrieve it?

Lastly, does the answer change if multiple people will be using the root account (password sharing best practices)?

share|improve this question
1  
I can't make any sense out of your mention of hash value. –  psusi Feb 19 '13 at 15:52
2  
You should probably post the comments that stand out the most on that page instead of linking to external content that may or may not be there in the future. –  llua Feb 19 '13 at 15:59
    
@psusi sorry about that, just added the relevant quotation –  tim peterson Feb 19 '13 at 16:01
add comment

1 Answer

The reason sudo is better than having a root password and using su in a multi admin environment is because with su, every admin has to know the root password, so if you ever want to revoke an admin's access, you have to change the password, and tell all of the other admins. With sudo you just remove them from the admin group.

sudo also offers more fine grained control, because you can configure it to allow people to run only a specific set of commands as root. For instance, you can allow helpdesk people to run passwd to reset users's passwords, without giving them full root access.

The quote you mention is actually wrong. Ubuntu locks the root account by default, so it has no password, but can not be logged in as. It also has a patched sulogin so that if the listed value in /etc/shadow is a bare "!" character ( the default, locked, no password value ), then single user/recovery mode will not prompt you for a root password to login.

share|improve this answer
    
thanks, so what you're saying is using sudo i is an ok practice? I guess i'm confused b/c than anyone that accesses the machine can just type sudo i and do what they want. Is that fear not warranted? –  tim peterson Feb 19 '13 at 16:12
    
@timpeterson only users in the admin group can use sudo. –  Random832 Feb 19 '13 at 16:13
    
@Random832 how is the admin group defined? I obviously am part of it but confess I have no idea what I did during the setup which made me an admin. –  tim peterson Feb 19 '13 at 16:17
    
@timpeterson, sudo is configured via /etc/sudoers, and the installer puts the initial user it prompts you to create in the admin group automatically. You should read the sudo man page for details. –  psusi Feb 19 '13 at 16:27
2  
@timpeterson, yes.. if you want a root shell instead of just prefixing an individual command with sudo, then sudo -i or sudo -s is the way to go. The difference between the two is that -s preserves your environment so for instance, ~ still refers to YOUR home directory, instead of root's. This is usually the preferred behavior. The su equivalent to this difference is su vs su -. –  psusi Feb 19 '13 at 16:34
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.