In windows it is possible to change administrator
username for security reasons. Is it possible to change root
username in Linux too?
2 Answers
While it's technically possible, it is probably not a good idea. You would have to audit all the code on your system to check if any of it has the root
user name hard-coded.
While the recommended practice for e.g. shell scripts is to check the user ID (if it's zero, you are root
) or check for the actual privilege you require (if you can write a file where you want to, who cares which precise user you are running as) but not all programs adhere to the recommendation. (In fact, the installers and/or packaging scripts for many popular commercial software packages contain some truly atrocious shell scripting.)
A hack which was employed by BSD once upon a time was to have a duplicate user in /etc/passwd
with the same user and group ID, but a different user name (and a different shell, which was the purpose of this exercise); they called this user toor
. This hardly helps for your particular use case, but may still be useful as guidance. The fact that this (generally) worked is a good indication that you could simply rename root
altogether.
-
1I tend to rename my linux uid 0 accounts to 'toor' to have an uniform account name on all my servers. So I know it is possible. It also help to identify broken software which checks for account names.– HennesJul 1, 2013 at 12:27
-
@Hennes Thanks for the report from the field! Could you try to quantify the amount of actual breakage? The fact that you have observed some might already be enough to deter some experimenters, though.– tripleeeJul 1, 2013 at 13:13
-
It's possible to change the name of the root account: edit your passwd
file. You'll break stuff, because various applications assume that the root account is called root
. (That's why it's called a “root account”, after all.)
Renaming a system account isn't supported any more than renaming some random system file is supported, or applying rot13
to a system file.
There is zero security benefit in renaming the root account. It will not help against any exploit. Root exploits work by causing a program running as root to execute code that it shouldn't execute. The name of the account is completely immaterial. It's like painting your front door a different color: it won't help you against burglars, you need to work on having a good lock, barring your windows, etc.
-
1It does help against brute-force password guessing attempts by forcing the attacker to also guess a valid account name. Of course, on any well-maintained system, remote root logins are already disabled, anyway.– tripleeeOct 21, 2016 at 13:52
-
@tripleee If your passwords are not a lot harder to guess than your account names, fix that. Oct 21, 2016 at 19:42
-
1The amount of guesses to find a valid account name multiplied by the amount of guesses to guess any one password is a measure of your password security. If you have a guessable account name, the first factor is one. You can increase it by not having guessable account names. The size of the second factor is unimportant; the observation here is that the first factor can be manipulated to your advantage. (Or rather, you can screw it up and not have that factor.)– tripleeeOct 22, 2016 at 18:13
/sbin/nologin
and clear his password.