Root to the Minimal

Question

I am building a script to automate and minimize access to root. I am going to try do it via SSH. I am currently having an issue using sed to replace UID and GID 0 shell to /sbin/nologin.

Why am I doing this? This disables root on login, gdm, kdm, su, ssh, scp, sftp. I am trying to execute root privilege only via sudo. If you know any suggestion on minimizing root access, please also suggest.

This is the current issue:

grep :0:0: /etc/passwd | sudo sed 's_/bin/bash_/sbin/nologin_' /etc/passwd

What is currently doing is replacing all /bin/bash to /sbin/nologin.

Answer 1

1. get a acount which is a sudoer

su -
echo '<YOU>  ALL=(ALL:ALL)  ALL'>>/etc/sudoers
exit

2. disable the root account

sudo usermod --expiredate 1 root

3. test it

$ su -
Password: <correct password>
Your account is expired.

Tested on Debian GNU/Linux

Answer 2

what

grep :0:0: /etc/passwd | sudo sed 's_/bin/bash_/sbin/nologin_' /etc/passwd

do ?

• grep :0:0: /etc/passwd search for line(s ?) with uid/gid being 0, this usualy give the line with root, this line is feeded to STDOUT (standard output )
• | output from grep is feed to sudo sed which is discarded due to a file being specified in command line.
• sed 's_/bin/bash_/sbin/nologin_' /etc/passwd this replace bash by nologin from /etc/passwd to STDOUT, /etc/passwd is left unchanged.

have you simply try .. ?

sudo sed -i '/:0:0:/s_/bin/bash_/sbin/nologin_' /etc/passwd