1

I have a headless server (CentOS 6.7 in my case).

Presumably in almost all circumstances commands issued as root should use sudo.

Is it possible, and wise, to completely disable password access for root? I know this is the default policy for, say, an Ubuntu desktop box, but I'm not sure it's the right choice in most cases.

1

There are very few instances when you need to use a root shell for anything. In fact, the only time I find myself at an actual root shell prompt is those few times when I'm configuring a new user for myself when setting up a new system.

The Ubuntu way of doing things, i.e. to lock the root account completely, is IMHO a good idea.

This is not the same as having a root account with an empty password, which would be a truly terrible idea.

The downside with sudo is that it's potentially difficult to configure for a novice, if anything other than "give some users full root access" is needed on a multi user system.

  • 1
    Curious. How does maintenance mode work on a system with a locked root account? – roaima Jan 27 '17 at 14:47
  • @roaima My Unix drops me into a root sh prompt upon booting single-user. Most Linuxes I know of will do the same, or can be done to do the same by giving the right boot parameters. If you have physical access to the machine, you have access to a root shell prompt in my experience. – Kusalananda Jan 27 '17 at 14:54
  • @Kusalananda This is not the same as having a root account with no password...: I assume you mean that the root account should not have an empty password. – user1071847 Jan 30 '17 at 13:40
  • 1
    @user1071847 Yes. I will make it clearer. – Kusalananda Jan 30 '17 at 14:09
  • 1
    There was a person on the Ubuntu SE who was very sad when his root had no password. He had set his main user to use zsh, and then uninstalled the zsh package. He had no other accounts who could su or sudo than his main one – infixed Jan 30 '17 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.