4

Confession. I know little about linux, am an XP refugee, and try to do things I don't understand. I generally find it easier to find out how to do things, than to understand whether I should be doing them in the first place.

I am using Mint 18. At my then level of understanding, it seemed that having the same password for sudo and my user account was less strong than having different ones. I now understand that root is disabled by default on Ubuntu/Mint intentionally.

After searching on the web, I did something to enable a separate password, not sure what, my notes aren't clear around that date, but I edited a file. Needless to say I can't remember exactly what search I was using to get me back to those instructions.

The result was that I was able to set a separate password for root, which probably means I enabled the account. Now when I sudo from the terminal, it requires the root password. When I do admin type things from the GUI, some things (update manager) need my user password and others (backup tool) needs the root password. As a result whenever a password box jumps up, I don't know which one it's asking for. If I understand correctly it's not improving security anyway, so I'd like to revert to how it was out of the box.

I've taken a full backup of my data to a different physical device, and if the worst comes to worst I can nuke and rebuild. After a bit of searching around, the following magic was suggested, sudo passwd -dl root which is supposed to disable the root account.

Is that what I want to do? What's the worst that could happen? Will that leave me able to sudo with my main account password? Are there any investigations it would be prudent to do on my machine, existence of control files for instance, before trying this?

4
  • First, let's find out what the current situation is. Forget the GUI for a second. Open a terminal and run: i) sudo ls and ii) su. Each of those commands should ask for a password. The sudo one should ask for your user's password, the one you use when logging in and the su one should ask for the one you set up for root. Can you confirm that this is indeed what's going on?
    – terdon ♦
    Dec 19, 2017 at 12:05
  • @terdon both sudo ls and su only respond to the one that's set for root.
    – Neil_UK
    Dec 19, 2017 at 12:11
  • OK, in that case, please show us the output of sudo grep -E 'rootpw|runaspw' /etc/sudoers. If either of those is set in that file, you would want to remove them as ilkkachu mentions below. Then you can decide if you also want to deactivate the root account. And no, the command you show won't do that, see man passwd (and not password).
    – terdon ♦
    Dec 19, 2017 at 12:17
  • @terdon to confirm, `Defaults rootpw' is present in the file. If I remove that now, will that brick anything? Will it give me single password access to my user account, sudo and su? Should I disable the root account subsequently? I don't have ssh server keys set up on this machine.
    – Neil_UK
    Dec 19, 2017 at 12:22

1 Answer 1

Reset to default
6

sudo by default asks for the calling user's password, but it can be configured to ask for either the password if root or the target user (which is also usually root).

The relevant configuration line would be Defaults rootpw or Defaults runaspw in /etc/sudoers, those would match the behaviour you describe. Removing them would reset the default behaviour. You should probably use visudo to edit the configuration file.

manual:

 rootpw            If set, sudo will prompt for the root password instead of the
                   password of the invoking user when running a command or edit‐
                   ing a file.  This flag is off by default.

 runaspw           If set, sudo will prompt for the password of the user defined
                   by the runas_default option (defaults to root) instead of the
                   password of the invoking user when running a command or edit‐
                   ing a file.  This flag is off by default.

If that was what sudo was configured to do, it means you have a password set for root, and the password can still be used to log in as root or change to root using su (not sudo). To disable/lock the password, you'd need to use e.g. that sudo passwd -dl root. The command is passwd, not password, for the same reasons all the other commands are so short. -d there deletes the old password hash, and -l adds a ! to lock the hash so that it's unusable.

This doesn't actually lock the whole account, it only makes the password unusable. You could still log in as root via SSH keys or such, but you probably have none installed.

5
  • 1
    Ah! Looking in /etc/sudoers, I notice I've left a comment that I added the line Defaults rootpw
    – Neil_UK
    Dec 19, 2017 at 12:17
  • I don't think passwd -dl root is the right command actually. In fact, the man page specifically states that will not disable root: "Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970)
    – terdon ♦
    Dec 19, 2017 at 12:27
  • 3
    @Neil_UK also, never edit /etc/sudoers! Use sudo visudo to make any changes to that file. This answer should be what you need, but you might want to drop by our /dev/chat to make sure you don't break anything :)
    – terdon ♦
    Dec 19, 2017 at 12:29
  • @terdon, I don't think root is actually completely disabled by default on Ubuntu (and I suppose Mint follows), just password-locked. Making the account expired also might affect stuff like cron (it does for regular users, but I didn't test for root)
    – ilkkachu
    Dec 19, 2017 at 12:35
  • I think it is disabled (but I'm not sure either). Point is, this still allows the presence of the root account and since the manual specifically states it isn't the right way to disable, I figure we may as well do what it suggests. Then again, disabling root completely might not be the best approach come to think of it. There must be someone with UID=1 after all.
    – terdon ♦
    Dec 19, 2017 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .