Disable root login in CentOS 7.2.1511

Question

Allegedly, if you are logged in as non-root and write sudo passwd -d root, root login will be disabled, meaning that you have to log in as another user and use su to switch to root (or just stick with sudo).

However, when I tried doing this, it did not disable root-login, but only removed the requirement for the password, essentially making anyone able to access root on my computer (very bad).

The book that told me to use sudo passwd -d root was written for CentOS 6.5. My version is 7.2. Is this a recent change or have I misunderstood something?

Answer 1

There is no point of restricting root login on local PC, because local user always can load system in single user mode with root privileges. If you need to block root login via ssh - it can be done in /etc/ssh/sshd_config by adding PermitRootLogin no

Answer 2

The easiest way to prevent root login is by corrupting the encrypted string which represents root's password in /etc/shadow. Normal lines in /etc/shadow looks like this:

1. Username : It is your login name.
2. Password : It is your encrypted password. The password should be minimum 6-8 characters long including special characters/digits and more.
3. Last password change (lastchanged) : Days since Jan 1, 1970 that password was last changed
4. Minimum : The minimum number of days required between password changes i.e. the number of days left before the user is allowed to change his/her password
5. Maximum : The maximum number of days the password is valid (after that user is forced to change his/her password)
6. Warn : The number of days before password is to expire that user is warned that his/her password must be changed
7. Inactive : The number of days after password expires that account is disabled
8. Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used.

(Quoted from here) You can add a ! (exclamation mark) which will not be generated from hash functions in the password section in root's line in /etc/shadow, which prevents login using all possible passwords. Now that you killed the password login method for root, no one can log in from nowhere as root using a password. (Other ways of logging in may exist, though)

A more safe way to do this is via the usermod utility: sudo usermod -L root This prevents you from messing things up. For detailed usermod usages, see usermod(8).

When you want to login with root, remove that ! and everything will be fine.

Answer 3

While the previous answer picked up on my comments about blocking root with usermod -L or passwd -l and effectively setting the password field to !, they do no explain your predicament.

I have been thinking why the book says that deleting with passwd -d prevents access. When you set the password to a blank, with -d, you will prevent all non root users to access the root account remotely, because non-root users cannot move to another accounts that have no password. As ssh nowadays also blocks root by default, the root account will be effectively blocked from the perspective of remote and non-root users. (e.g. the only way as working as root will then be sudo)

Nevertheless, the book should mention any user in the local console can login as root without password. Whist nowadays most of the consoles are out of reach of normal users in the console of virtual environments, it is always sensible to have a way of controlling root password.

A more sensible policy as such is blocking root with usermod -L or passwd -L, but not before establishing a sensible user policy, and testing it.

An alternative is to establish a very secure root password that is changed regularly that no one knows (generating it randomly with makepasswd and keep it in an envelope for instance) for emergency cases (single-boot for instance, or when someone mistakenly messes up the sudo configuration. Then indeed the root password can come handy. This way, privileged work via sudo will be enforced. Otherwise, with root locked, the alternative is booting via a CD or pen, either virtual or real.