0

There's been a lot of articles that state to disable root user and create a new user. One of the reasons is that root is a known account and bots can easily target.

So I need to create a new user with admin privileges. If I do this then, is this exactly the same power as root?

I need to install MongoDB, NodeJS, PM2, Certbot. Last time I did this I got into a mess and I ended up reverting to root. The problem seemed to be related to how this software was installed and how it was being run.

I now have a new build and want to try again. I have SSH root access and enabled password for root currently (back-up) and ready to create a new account as needed.

Which account should I use to install the software and which account should run the software with?

Also, when a user is created a folder in home folder is created, is this where I should add my node application?

I will be the only admin. (i.e. Its not going to be used in an organisation), should this make a difference.

3
  • root should install system-wide software. What account runs it depends on the software. As a rule of thumb, running processes as root is often not a good idea, unless the process requires it (i.e. the initial apache2 process)
    – Panki
    Commented Apr 9, 2021 at 9:33
  • 1
    The usual approach is to disable root logins in the sshd_config file rather than renaming the superuser. Commented Apr 9, 2021 at 10:35
  • If I disable root login, how can I install the software. Should I create a new user first with SU, login with this over ssh, switch to root user (assuming I still can), then install applications? Commented Apr 9, 2021 at 10:59

1 Answer 1

2

First, to clear up a possible misunderstanding: The recommendation to disable the root user means to disable the possibility to log in as the root user. It does not imply "removing" the root user from the system (which is impossible). Instead, the idea is to allow a "trusted" normal user (this can be your normal user account or a dedicated account you create for only that purpose) to execute commands with root privileges.

1. Enable an ordinary user to become root

Be sure to do this before proceeding to step 2!

This is usually performed via sudo. The easiest way is make the "trusted" normal user part of the sudo group and allow members of that group to execute commands with root privileges by prepending the call with sudo. For that purpose:

  1. Install sudo (if not already present on your system)
  2. execute (as root):
    ~# usermod -a -G sudo trusted_user
    
  3. Ensure that the /etc/sudoers file contains a line like
    %sudo ALL=(ALL:ALL) ALL
    
    This is likely already present and will allow users in that group to execute all commands with root privileges via sudo.

2. Disable root login

There are several ways to do this, depending on how hard you want to "disable" the account. Two of the most useful are:

  • Set the root user's login shell to /sbin/false or /sbin/nologin (depending on whether you want to have a nice explanatory message displayed upon attempt or not). To to so, change (as root) the last :-separated field of /etc/passwd to one of the above. Note that you then will truly be no longer able to actually become root, you can then only work on a "command-by-command" basis with root privileges via sudo (but you can undo this by modifying the password file under sudo if you later change your mind).
  • Disable the root password. To do so, set the password hash of the root user, which is the second :-separated field of /etc/shadow, to !. It is recommended to modify that particular file only via vipw -s (as root). You will then no longer be able to log in as root via password-based authentication. Switching to root via sudo su is still possible (if the sudoers file allows), as is logging in via SSH keys (if set up).

Final notes

Your original problem appears to be that you tried to install software system-wide as non-root user and ended up not being able to use it in the way you intended. The recommended steps to "disable" the root user account are not a workaround to this.

  • The best way to avoid a broken software installation is to use the distribution's package manager. This will require root privileges but ensure that all files are where they should be and that the software can be (more or less) easily uninstalled via the package manager.
  • If you have to install software from source or with a vendor-supplied installer, you can try to install it as you (or another dedicated "ordinary" user) in your home directory, and run the software as you. This will only work if the software doesn't require root access to resources (such as network ports below 1000 or hardware).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .