2

Should one always set a root password, or is sudo -i acceptable? Two problems is in reading other posts (maybe junk I realize):

  1. sudo -i eliminates the need for a password. Isn't that a problem for security reasons?
  2. there are conflicting views on whether to change the password from its original hash value:

By default the root user is setup with a random hash during the install of Ubuntu

If one should use the original hash value, I have no idea what mine is. How do I retrieve it?

Lastly, does the answer change if multiple people will be using the root account (password sharing best practices)?

3
  • 1
    I can't make any sense out of your mention of hash value.
    – psusi
    Feb 19, 2013 at 15:52
  • 2
    You should probably post the comments that stand out the most on that page instead of linking to external content that may or may not be there in the future.
    – llua
    Feb 19, 2013 at 15:59
  • @psusi sorry about that, just added the relevant quotation
    – tim peterson
    Feb 19, 2013 at 16:01

1 Answer 1

Reset to default
7

The reason sudo is better than having a root password and using su in a multi admin environment is because with su, every admin has to know the root password, so if you ever want to revoke an admin's access, you have to change the password, and tell all of the other admins. With sudo you just remove them from the admin group.

sudo also offers more fine grained control, because you can configure it to allow people to run only a specific set of commands as root. For instance, you can allow helpdesk people to run passwd to reset users's passwords, without giving them full root access.

The quote you mention is actually wrong. Ubuntu locks the root account by default, so it has no password, but can not be logged in as. It also has a patched sulogin so that if the listed value in /etc/shadow is a bare "!" character ( the default, locked, no password value ), then single user/recovery mode will not prompt you for a root password to login.

7
  • thanks, so what you're saying is using sudo i is an ok practice? I guess i'm confused b/c than anyone that accesses the machine can just type sudo i and do what they want. Is that fear not warranted?
    – tim peterson
    Feb 19, 2013 at 16:12
  • @timpeterson only users in the admin group can use sudo.
    – Random832
    Feb 19, 2013 at 16:13
  • @Random832 how is the admin group defined? I obviously am part of it but confess I have no idea what I did during the setup which made me an admin.
    – tim peterson
    Feb 19, 2013 at 16:17
  • @timpeterson, sudo is configured via /etc/sudoers, and the installer puts the initial user it prompts you to create in the admin group automatically. You should read the sudo man page for details.
    – psusi
    Feb 19, 2013 at 16:27
  • 2
    @timpeterson, yes.. if you want a root shell instead of just prefixing an individual command with sudo, then sudo -i or sudo -s is the way to go. The difference between the two is that -s preserves your environment so for instance, ~ still refers to YOUR home directory, instead of root's. This is usually the preferred behavior. The su equivalent to this difference is su vs su -.
    – psusi
    Feb 19, 2013 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .