I have set up sudo on my FreeBSD server. As I now never want to log in as root anymore, I was wondering whether I should do sudo pw lock root.

My questions are:

  • Is this possible, without forever disabling my machine?
  • Is it a smart idea, or is there a good reason to not do this?
  • Will I still be able to do sudo su to get a root shell?
  • 5
    This is actually the default configuration for Ubuntu: root account is locked, and sudo prompts for your own password. Running sudo to run su as root to run a shell as root is also redundant; just use sudo -s. – psusi Nov 29 '11 at 14:56

I actually did this on my FreeBSD box - so yes, it is possible, but of course you should take care to verify that sudo works properly before you do so ;-)

sudo su will not work anymore, but you can still do sudo bash to get a root shell.

  • 6
    or sudo -s will also get you a shell – psusi Nov 29 '11 at 14:55

It's possible, yes.

But it's not a very good idea. Locking out the account is equivalent to setting an absolutely unguessable password. You might as well set a practically unguessable password, i.e. one with sufficient entropy (128 bits, which comes out to 20 random printable ASCII characters, is massive overkill), and keep that password in a safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.