Is having root password for sudo considered a best practice or the opposite?

Question

I've set up my sudoers so that it asks the root password instead of the user password everytime I use sudo. Mainly because I believe it makes sense that if you want to execute a root command, you should know the root password.

However, could this be considered a security risk?

And if is not, why isn't this the default configuration in most distros?

Edit: I am running a personal Linux Machine, where I am the only user. Does the rationale make more sense in this context? I do think that this may not apply to multi-user systems.

Context: My experience with sudo was on systems where sudo was simply a "synonym" for su. One could run any root command by simply typing their user password, which I thought defeated the purpose of root to begin with. Hence my reasoning to have it ask you for the root password. Having said that I was unaware of the power of sudoers, some users mentioned that you could specify which commands can be run with sudo (while leaving out some commands restricted to the root user only). This I think is a great middle ground

Answer 1

Some would consider this a security risk because it undermines two of the main purposes of using sudo rather than su, which are:

1. sudo makes it easy to allow users to run some, but not all, commands as root, and

2. You don't have to give out the root password. Having the root password is potentially far more dangerous than just being allowed to run certain commands as root.

Once someone has the root password, they can either login as root or use it with su. It is also harder to revoke root access from just one person - you have to change the root password and let everyone know what the new password is. With sudo's default configuration, you only have to change the sudoers file and/or remove the user from the sudo group.

This is why it's not the default configuration for sudo.

I strongly recommend that you revert back to the default behaviour as it is almost certainly more well thought out than your belief that it "makes sense" that you should have to know the root password. "common sense" is usually neither "common" nor "sensible".

sudo was written, at least in part, to avoid the problems caused when everyone who needed some ability to do some root-level sysadmin tasks had to know the root password. In practice, this proved to be extremely problematic, especially in large environments like universities or corporations where people changed roles a lot.

I've worked in several environments over the years where people had moved on to other roles in the same organisations years before (or even left the organisation completely) but still had root access on machines that they shouldn't even still have a valid login on. There's also the issue that people often get upset when you do the actually right thing and remove root access and/or disable accounts when those things are no longer needed.

Answer 2

Consider a hypothetical (but very plausible) scenario: a user who has the root password mistakenly changes the password for root, and does not record it.

You now have a situation where no one has the root password, and thus no one can elevate to root. This effectively breaks sudo via root password for everyone, requiring remedial actions (with downtime) to reset the password.

Answer 3

The sudoers mechanism has many advantages compared to giving out the root password:

• Allowing to run a restricted set of commands as an admin

• Accountability, as commands run via sudo can be logged so to know who ran what

• Easy transfer of admin rights, simply by adding and removing users from the admin group

Giving all users the root password defeats completely the use of sudoers, since users won't need to use sudo: they'll login simply as root.

---

Edit after the OP's added:

Edit: I am running a personal Linux Machine, where I am the only user. Does the rational make more sense in this context? I do think that this may not apply to multi-user systems.

Effectively, if you are the only user on the system, the above doesn't apply and you can login as root instead of running sudo any time you need to operate as an admin. Be careful though that your action will have more impact, and it will be easier for you to damage the system. To quote an ancient UNIX Zen master:

"Only through root can true pain – and thus enlightenment – be achieved."

Answer 4

I tried to look at what the Ubuntu docs say about that.

The Ubuntu Server Guide mentions under User Management that

Ubuntu developers made a conscientious decision to disable the >administrative root account by default in all Ubuntu installations.

and

Instead, users are encouraged to make use of a tool by the name of ‘sudo’ to carry out system administrative duties. [... ]This simple yet effective methodology provides accountability for all user actions, and gives the administrator granular control over which actions a user can perform with said privileges.

And go on with instructions on how to enable the root account, by setting a password for it.

The Community Help Wiki at help.ubuntu.com, page RootSudo (archived), mentions ease of use, new users and not logging in as root all the time at first:

Please keep in mind, a substantial number of Ubuntu users are new to Linux. There is a learning curve associated with any OS and many new users try to take shortcuts by enabling the root account, logging in as root, and changing ownership of system files.

Both documents at best gloss over the option of having sudo ask a distinct password, but the wiki page has a list of upsides and downsides of the current system, and it at least gives an indication of what they might have thought.

The first two advantages listed are that the installer has fewer questions to ask, and that the user only needs to remember one password. Both are arguments for ease of use. The third listed one is an argument against logging in as root and for the extra step of sudo, namely in that it might make the user stop to think more about what they're doing:

3. It avoids the "I can do anything" interactive login by default. You will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing.

They also mention what @bxm said in their answer, that having a single root password (with or without sudo) would make it harder to deauthorize users, and the fact that sudo logs what it runs and can theoretically be configured to be more limited than allowing everything.

I say "theoretically", since e.g. setting rules to stop sudo from starting a shell are bound to fail against a determined abuser, as they can e.g. install a distinctly named shell (countering any blacklists), or just install a setuid shell binary (bypassing the need for sudo to start with). Both can be done with just cp and chmod.

Given that properly setting up whitelists for sudo isn't that simple, and the fact that there seems to be little instruction on how to do it, I'm guessing the part about ease of use, chance of forgetting a more seldom-used root password, and having each password used by just one person are the main reasons.

_{(Note that it's technically possible to have distinct root/sudo passwords for each user, in addition to their normal user account passwords. At least one way to do that is to create multiple UID 0 accounts, set the targetpw option in sudoers, and then have the users sudo to their own root account instead of root. E.g. the regular user john could have a corresponding root user john_root, and when they needed, they'd run sudo -u john_root whatever command it was. Of course you could do the same with just su instead of sudo. The downside of this is that for reasons I've never understood, some people seem to vehemently oppose having multiple named accounts with the same UID.)}

Answer 5

Your question suggest that you are the only user on that system (I've set up my sudoers … everytime I use sudo), while the given answers are viewing it mainly from the multi-user point of view.

The reason for the default configuration is the original idea for sudo: To give restricted superuser access to certain users.

In today's Linux distributions the idea is probably more like yours: Easy access to restricted areas of your system with a small »please beware« reminder.

To use the root password in this scenario has one main advantage (if a root password is set at all):

If sudo rights are properly configured, knowing your password only harms your account, not the whole system (potentially including your backup. You need a second key to enter the machine room.

Answer 6

Is having root password for sudo considered a best practice?

no

those user's who should have root permissions or elevated permissions are placed in the wheel group. Then only those users can su to root or rather use sudo. Using su requires typing the root password, which is the bad practice and what you want to avoid. Using sudo specifically sudo -i is a very nice way to get a root prompt which doesn't require typing the root password, the user types their password and it only works if they are in the wheel group.

in /etc/sudoers there is

• sudo -i requires the given user to type their password, and not the root

## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

That is the default configuration, at least in RHEL/CentOS 7.x; it is a happy medium. First the user has to be in the wheel group to use su or sudo. I'm not sure how to properly prevent a wheel group person from using su but even using sudo -i they can still change the root password and cause problems. So it is in /etc/sudoers with using visudo that you would want to reconfigure and undo the ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL. For a home linux system this is all overkill, but a work environment with legal implications and all that is when it becomes significant.

It was mentioned I've worked in several environments over the years where people had moved on to other roles in the same organisations years before (or even left the organisation completely) but still had root access on machines that they shouldn't and even still have a valid login on. That is not the fault of su or them having known the root password, that's a problem of existing adminsand management not doing proper housekeeping and changing the root password and deleting/expiring the employee's login.

The obvious pitfall is any wheel group admin can change the root password and cause havoc. To prevent that edit that line in /etc/sudoers to %wheel ALL=(ALL) ALL, !/usr/bin/passwd root. And also %wheel ALL=(ALL) ALL, !/bin/su root. I would say this and simple use of the wheel group is a best practice first step. Then edit /etc/sudoers to restrict administrative roles and use more admin groups other than wheel to accomplish a reasonable security for who should and should not be able to do what.

Answer 7

However, could this be considered a security risk?

Yes. It is always a bad idea to hand out roots password.

I would add my own $0.01 (inflation has taken its toll)... I use sudo, without asking for a root password. However, I do set a root password. In other words, when using sudo, you use your own password. If, however, you were at a console and logged in as root, it would not be passwordless and not let you login. It has a password set. A lot of new users do not setup roots actual password and exclusively use sudo. This is fine, until you are dropped to a command prompt during a filesystem issue upon boot (for example), and you need to type roots password for maintenance.

Just a thought.