3

From a security standpoint should I disable the root account for my personal computer running Debian 9.1?

And if so: what would be the best way to do this?

closed as unclear what you're asking by mdpc, Timothy Martin, Thomas Dickey, Jeff Schaller, Stephen Rauch Aug 2 '17 at 0:23

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There is no way to disable the root account. An account with number 0 (and usually called root) must always exist. What could be done, and is done in Ubuntu (and some other distros) is remove the root account password. So, no login to root could be succesful, no ssh could log in as root, no matter how hard it try, only by using sudo could an user raise its privileges to root. Should you do it? Sure, why not?. Is it more secure? Yes, a little (as long as no user is running shells as root for a long time). – Arrow Aug 2 '17 at 4:41
8

There are different reasons to disable root account, for example:

  1. Your system is available on a network and you want to protect yourself against brute force attacks, so no one can guess your root account password.

  2. Developers wants to stop the users from running a command like su - to get a full root shell, because it's now a lot easier to do something wrong which causes damage to the system. however they can still use something like sudo -i, sudo -s, sudo /bin/some-shell or even sudo su - if they are in sudoers file

    The idea is to force the user to use the sudo instead of sharing a single root password between all users and using the sudo comes with some advantages, for example:

    • It's less likely for you to leave an open shell with complete root access, sudo permissions expires after a while.
    • You can define more flexible ruels using sudoers file
    • It logs who is doing what, etc.
    • Read here for more info.

To disable, you can remove the password of the account or lock it down, or even do both of them:

  1. Remove the root password:

    sudo passwd -d root
    
  2. Lock the account:

    sudo passwd -l root
    
  • Am I mistaken that passwd -d root should allow becoming root without even a password prompt challenge and passwd -l root is a must to deny this? – Fiximan Aug 2 '17 at 7:09
  • Yeah, that's wrong, you can't login into a account when it doesn't have any password, check it yourself... also you can' unlock a locked account if it doesn't have any password too. – Ravexina Aug 2 '17 at 7:59
  • I locked the root account. Now I have the problem that I can't de/install packages via Apper anymore as I get an "Authentication failure" when I enter my root password when it asks for it. It only works if I start apper as root via sudo apper. But if I do that apper looks strange and old (e.g. no icons) and I get a number of errors in the console. Is this normal? How can I keep using apper to install and deinstall software while at the same time locking the root account login? – mYnDstrEAm Aug 2 '17 at 12:44
  • As I said before, we use sudo instead of root account directly, so what you are doing (using sudo) is the correct way to do it. why you are getting an ugly look? I guess it's because you are running the apper using sudo (root user) and your root user doesn't have a proper theme/icon selected. you can install lxappearance then run it using sudo lxappearance select a theme and Icon then you should be fine. – Ravexina Aug 2 '17 at 13:10
  • @Ravexina Didn't notice you commented and now I've put up a new question with all the errors I get. I don't have lxappearance in KDE but maybe there's an equivalent for KDE. – mYnDstrEAm Aug 2 '17 at 13:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.