I tried to look at what the Ubuntu docs say about that.
The Ubuntu Server Guide mentions under User Management that
Ubuntu developers made a conscientious decision to disable the >administrative root account by default in all Ubuntu installations.
Instead, users are encouraged to make use of a tool by the name of ‘sudo’ to carry out system administrative duties. [... ]This simple yet effective methodology provides accountability for all user actions, and gives the administrator granular control over which actions a user can perform with said privileges.
And go on with instructions on how to enable the
root account, by setting a password for it.
The Community Help Wiki at help.ubuntu.com, page RootSudo (archived), mentions ease of use, new users and not logging in as root all the time at first:
Please keep in mind, a substantial number of Ubuntu users are new to Linux. There is a learning curve associated with any OS and many new users try to take shortcuts by enabling the root account, logging in as root, and changing ownership of system files.
Both documents at best gloss over the option of having
sudo ask a distinct password, but the wiki page has a list of upsides and downsides of the current system, and it at least gives an indication of what they might have thought.
The first two advantages listed are that the installer has fewer questions to ask, and that the user only needs to remember one password. Both are arguments for ease of use. The third listed one is an argument against logging in as root and for the extra step of sudo, namely in that it might make the user stop to think more about what they're doing:
- It avoids the "I can do anything" interactive login by default. You will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing.
They also mention what @bxm said in their answer, that having a single root password (with or without sudo) would make it harder to deauthorize users, and the fact that sudo logs what it runs and can theoretically be configured to be more limited than allowing everything.
I say "theoretically", since e.g. setting rules to stop
sudo from starting a shell are bound to fail against a determined abuser, as they can e.g. install a distinctly named shell (countering any blacklists), or just install a setuid shell binary (bypassing the need for
sudo to start with).
Both can be done with just
Given that properly setting up whitelists for
sudo isn't that simple, and the fact that there seems to be little instruction on how to do it, I'm guessing the part about ease of use, chance of forgetting a more seldom-used root password, and having each password used by just one person are the main reasons.
(Note that it's technically possible to have distinct root/sudo passwords for each user, in addition to their normal user account passwords. At least one way to do that is to create multiple UID 0 accounts, set the
targetpw option in
sudoers, and then have the users
sudo to their own root account instead of
root. E.g. the regular user
john could have a corresponding root user
john_root, and when they needed, they'd run
sudo -u john_root whatever command it was. Of course you could do the same with just
su instead of
sudo. The downside of this is that for reasons I've never understood, some people seem to vehemently oppose having multiple named accounts with the same UID.)