2

The accepted answer to How do I completely remove root password suggests passwd -d root ("deleting" the password), and a comment suggests instead using passwd -l root ("locking" the password). The only difference seems to be that a locked password can be unlocked by removing the initial "!" before it. Are there any other practical considerations, particularly related to security and disabling the root account?

2
  • 1
    Have you read this comment? I believe this is one of the practical and important difference. – ynn Nov 29 '19 at 8:37
  • Oh deleting a password == setting it to the empty string? That's surprising, especially since setting an empty password is trivial. I thought it would delete the hash from /etc/shadow, effectively doing something similar to locking but not allowing password recovery. – l0b0 Nov 29 '19 at 11:02
1

According to man 1 passwd,

-d, --delete

    Delete a user's password (make it empty). This is a quick way to disable a password for an
    account. It will set the named account passwordless.

Practically, you can see the difference when you use CUI (not a terminal emulator). After you execute passwd -d root, you can login as root even without being prompted for the password since the password is empty. The similar thing is observed when you use su command (see this comment for example). In contrast, after passwd -l root, you cannot login as root using password[1].

So just deleting the password of root is strongly discouraged, while locking it has many advantages and that is chosen as the default setting on some environment like Ubuntu. RootSudo - Ubuntu Community Help Wiki has much information about this.


[1]: Locking a password doesn't mean the user is completely disabled. You can still login using non-password authentication (e.g. SSH key or sudo). See man 1 passwd for the detail.

2
  • Again, the ambiguity of "delete" is surprising. I thought for sure someone without a password could not log in, at least on a *nix system from the 90s onwards. – l0b0 Nov 29 '19 at 19:28
  • @l0b0 I agree with you. I was also confused when I first tried to understand the difference. – ynn Nov 30 '19 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.