Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I needed to enable the root account for whatever reason and being offline I had no better advice than this manual man sudo root

"This is not recommended!

To enable the root account (i.e. set a password) use:

sudo passwd root

Afterwards, edit /etc/sudoers and comment out the line

%admin ALL=(ALL) ALL

to disable sudo access to members of the admin group."

So I followed the two steps and the result was I still couldn't access the root account because I didn't activate it in the login screen, only now I also lost the admin rights to my default user which left me in a permission limbo, since then I edited the sudoers from a CD boot and restored the settings but still...

Was the manual really a bad advice or was there a better way than this to revert or complete the process?

share|improve this question
    
The root account will not usually be in your login list, you should switch to a virtual terminal and then log in –  Minato Namikaze Feb 20 '13 at 9:10
    
@Dmitry Atlasman - These instructions do not permanently block sudo access but are misleading. I have reported a bug here You may want go to it a select "Affects me too" to increase the likelihood of it getting fixed in later releases. –  Warren Hill Feb 21 '13 at 21:27
add comment

1 Answer

Following the instructions in man sudo root on how to go back to a tradidional root account does not permanently block sudo.

The first point to note here is that going back to a traditional root account is not recommended. The root log-on is disabled by default for a number of very good reasons and its almost never necessary to enable the root log-on.

Some benefits of leaving Root logins disabled by default include the following:

  1. The Ubuntu installer has fewer questions to ask.
  2. Users don't have to remember an extra password (i.e. the root password), which they are likely to forget (or write down so anyone can crack into their account easily).

  3. It avoids the "I can do anything" interactive login by default (e.g. the tendency by users to login as an "Administrator" user in Microsoft Windows systems), you will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing.

  4. sudo adds a log entry of the command(s) run (in /var/log/auth.log). If you mess up, you can always go back and see what commands were run. It is also nice for auditing.

  5. Every cracker trying to brute-force their way into your box will know it has an account named Root and will try that first. What they don't know is what the usernames of your other users are. Since the Root account password is locked, this attack becomes essentially meaningless, since there is no password to crack or guess in the first place.

  6. Allows easy transfer for admin rights, in a short term or long term period, by adding and removing users from groups, while not compromising the Root account.

  7. sudo can be setup with a much more fine-grained security policy.
  8. The Root account password does not need to be shared with everybody who needs to perform some type of administrative task(s) on the system (see the previous bullet).
  9. The authentication automatically expires after a short time (which can be set to as little as desired or 0); so if you walk away from the terminal after running commands as Root using sudo, you will not be leaving a Root terminal open indefinitely.

That said lets look at what these commands actually do on a live system. Because the name of the group for administrator users changed from admin to sudo with the release of precise I tested this on both 10.04 and 12.04. Both tests were using Virtualbox as I have no intention of bricking a real system.

Starting with Ubuntu 10.04 I enabled the root accout with sudo passwd root then edited the sudoers file with sudo visudo and rebooted. When I rebooted only my name was listed and when I logged in sudo did not work. However I was able to become root by entering su in a terminal and the root password. I was also able to log out and back in as root. root was not listed as a user but I could type it in.

Next I tried Xubuntu 12.04 I enabled the root accout with sudo passwd root then edited the sudoers file with sudo visudo and rebooted. When I rebooted only my name was listed and when I logged in sudo still worked. I was able to become root by entering su in a terminal and the root password. I was also able to log out and back in as root. root was not listed as a user but I could type it in.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.