Root account or no root account?

[claydoh]

I will second the thoughts that one is not better or worse than the other. The real thing is whether or not there is any reason to switch from one to the other.

to reiterate some points:
1) With sudo, an external 'hacker" needs to discover not only the password, but the username as well.
2) Look at some problems that crop up when users have enabled the root account in sudo centric distros

However
1) The permissions problems that crop up when running gui programs with sudo instead of kdesudo/gksudo. Now, 99 % of these shouldn't be run with admin privileges to begin with, but we all know how that works out
2) Sudo has a (configurable) time out where the password is cached in the desktop session (terminal instances' timeout are separate, and unique to each instance iirc)


The real question is, again, why change the thing, what is broken about how it works? That is what the criteria for one or the other lies.
You will find the vast majority here will tell you sudo is fine. A lot of that stems from actual experience as opposed to any bias or wish to stifle differences.

[andystmartin]

Another benefit from sudo is that it encourages people to mostly do their work as a "normal" user and only do "privileged" operations as needed. Whereas, with su it is normal for people to start up a shell as root and remain in that mode for extended periods of time. When in a root shell, it is easy to for a user to forget that they are privileged and do some unintended damage. A user can do considerable damage in either "su" or "sudo". But in my experience, fewer "accidents" occur with "sudo".

I would not classify this as "authentication" security. Rather, it's more security against "stupidity".

[oshunluvr]

I don't think one way is more secure than the other in terms of "security" as opposed to safety. A password is only as strong as it's creator. If you're in the habit of writing down your password and leave it laying about, it's no good at all. If you follow the "strong" password rules then you're as safe as that portion of your system can be.

I'm not even convinced that sudo vs. su is any safer, it just imposes a layer of one additional step to most actions that requires you to enter your password once again every so often. Even this can be easily changed by those inclined to do so.

My previous primary distro did it the other way (root account enabled by default, sudo disabled). I will say I trashed that install way more often than this one, but more likely that was lack of knowledge rather than the place I had to enter a password. It's really more of a philosophy than a real substantive change.

I can see a proper place for both environments. If you allow others (the wife, business partner, kids) to use your computer while you're logged on, I'd disable sudo. Otherwise, set it up whichever way you prefer. Although James' point about the guide is well taken, I suspect if you're savvy enough to close sudo and setup your root account you'll understand if differences when reading a HowTo.

I suspect the only valid reason to not enable root is this one, also from James:

* Most automated scripts on the internet tend to attack weak password on the root account (otherwise they have to guess the username which is harder to do) - but this is moot if you are behind a firewall/router.

This highly depends on the situation but I feel that both can be secure as each other. Some things you might want to note:

* Kubuntu is designed to work with a locked root account - all the guides are written for it
* Most automated scripts on the internet tend to attack weak password on the root account (otherwise they have to guess the username which is harder to do) - but this is moot if you are behind a firewall/router.
* If you share user accounts then you need a separate administrator account anyway to stop other users doing things they shouldn't.
* You can cause allot of damage if you do the wrong thing while logged in as root (or if you run everything with sudo even if you don't need to)

Personally I like to use sudo and keep the root account locked that way I don't need to remember two different passwords (or remember to update both when I change them).

Yes I know Kubuntu is designed to work with a locked Root account. I also know the amount of damage you can do should you use the root account as a normal account, but are you saying you can't do the same amount of damage using your sudo enabled account?

I was asking which in your opinion was more secure? Or are they both as secure as each other?

[james147]

Which of these is better for security?

1. Disable root account and have at least one user account as a "sudoer" whereby you only need to enter your personal password to change system settings.

2. Have a root account and a "normal" account whereby you need to log in to the root account to change system settings then log out again.

This highly depends on the situation but I feel that both can be secure as each other. Some things you might want to note:

* Kubuntu is designed to work with a locked root account - all the guides are written for it
* Most automated scripts on the internet tend to attack weak password on the root account (otherwise they have to guess the username which is harder to do) - but this is moot if you are behind a firewall/router.
* If you share user accounts then you need a separate administrator account anyway to stop other users doing things they shouldn't.
* You can cause allot of damage if you do the wrong thing while logged in as root (or if you run everything with sudo even if you don't need to)

Personally I like to use sudo and keep the root account locked that way I don't need to remember two different passwords (or remember to update both when I change them).

Which of these is better for security?

1. Disable root account and have at least one user account as a "sudoer" whereby you only need to enter your personal password to change system settings.

2. Have a root account and a "normal" account whereby you need to log in to the root account to change system settings then log out again.