TL;DR: Do things as root only when you have to. sudo
makes this pretty easy. If you enable root logins, you can still follow this rule, you just have to be careful to do so. Although enabling root logins is not actually insecure if done right, you don't need to enable root logins because you have sudo
.
There are really two related questions here.
- Why is it bad to to log in as root for one's everyday computer use (web browsing, email, word processing, gaming, etc.)?
- Why does Ubuntu default to disabling root logins altogether and using
sudo
and polkit to enable administrators to run specific commands as root?
Why not run everything as root, all the time?
Most of the other answers cover this. It comes down to:
- If you use root powers for tasks that don't require them, and you end up doing something you didn't mean to do, you could change or harm your system in a way you don't want.
- If you run a program as root when you didn't need to, and it ends up doing something you didn't mean for it to do--for example, due to a security vulnerability or other bug--it could change or harm your system in a way you don't want.
It's true that even without doing things as root, you can cause harm. For example, you can delete all the files in your own home directory, which usually includes all your documents, without running as root! (Hopefully you have backups.)
Of course, as root, there are additional ways to accidentally destroy those same data. For example, you could specify the wrong of=
argument to a dd
command and write raw data over your files (which makes them way, way harder to recover than if you'd merely deleted them).
If you're the only person who uses your computer, the harm you can do only as root might not really be higher than the harm you can do with your regular user privileges. But that is still no reason to expand your risk to include additional ways of messing up your Ubuntu system.
If running with a non-root user account prevented you from exercising control over your own computer, then this would of course be a bad tradeoff. But it doesn't--anytime you actually wish to perform an action as root, you can do so with sudo
and other methods.
Why not make it possible to log in as root?
The idea that the ability to log in as root is inherently insecure is a myth. Some systems have a root account enabled by default; other systems use sudo
by default, and some are configured with both.
- For example, OpenBSD, which is widely and reasonably considered the most secure general-purpose OS in the world, ships with the root account enabled for local, password-based login.
- Other well-respected OSes that do this include RHEL, CentOS, and Fedora.
- Debian (from which Ubuntu derives) has the user decide which approach will be configured, during system installation.
It's not objectively wrong to have a system where the root account is enabled, provided that
- you still only use it when you really need to, and
- you restrict access to it appropriately.
Often novices ask how to enable the root account in Ubuntu. We should not conceal this information from them, but usually when people ask this it's because they are under the mistaken impression that they need to enable the root account. In fact, this is almost never necessary, so when answering such questions it's important we explain that. Enabling the root account also makes it easy to become complacent and perform actions as root that don't require root privileges. But this doesn't mean enabling the root account is by itself insecure.
sudo
encourages and helps users run commands as root only when they need to. To run a command as root, type sudo
, a space, and then the command. This is very convenient, and many users of all skill levels prefer this approach.
In short, you don't need to enable root logins because you have sudo
. But so long as you use it only for administrative tasks that require it, it's about equally secure to enable and log on as root, so long as it's only in these ways:
- Locally, from a non-graphical virtual console.
- With the
su
command, when logged in from another account.
However, substantial added security risks arise if you log on as root in these ways:
Graphically. When you log in graphically, a whole lot of stuff runs to provide the graphical interface, and you'll end up running even more applications as root to use that interface for anything. This goes against the principle of only running programs as root that really need root privileges. Some of these programs may contain bugs, including security bugs.
Furthermore, there's a non-security reason to avoid this. Logging in graphically as root is not well supported--as loevborg mentions, developers of desktop environments and of graphical apps don't often test them as root. Even if they do, logging in to a graphical desktop environment as root doesn't get real world alpha and beta testing by users, as almost nobody attempts it (for the security reasons explained above).
If you need to run a specific graphical application as root, you can use gksudo
or sudo -H
. This runs far fewer programs as root than if you actually logged on graphically with the root account.
Remotely. The root
account can in effect do anything, and it has the same name on practically every Unix-like system. By logging in as root via ssh
or other remote mechanisms, or even by configuring remote services to allow it, you make it much easier for intruders, including automated scripts and malware running on botnets, to gain access through brute force, dictionary attacks (and possibly some security bugs).
Arguably the risk is not extremely high if you allow only key-based, and not password-based root logins.
By default in Ubuntu, neither graphical root logins nor remote logins via SSH are enabled, even if you enable logging in as root. That is, even if you enable root login, it's still only enabled in ways that are reasonably secure.
- If you run an ssh server on Ubuntu and have not changed
/etc/sshd/ssh_config
, it will contain the line PermitRootLogin without-password
. This disables password-based root login, but allows key-based login. However, no key is configured by default, so unless you've set one up, that too will not work. Furthermore, key-based remote root login is far less bad than password-based remote root login, in part because it doesn't create the risk of brute force and dictionary attacks.
- Even though the defaults should protect you, I think it's still a good idea to check your ssh configuration, if you're going to enable the root account. And if you're running other services that provide remote login, like ftp, you should check them, too.
In conclusion:
- Do stuff as root only when you need to;
sudo
helps you do that, while still giving you the full power of root anytime you want it.
- If you understand how root works and the dangers of overusing it, enabling the root account is not really problematic from a security perspective.
- But if you understand that, you also know that you almost certainly don't need to enable the root account.
For more information about root and sudo
, including some additional benefits of sudo
that I haven't covered here, I highly recommend RootSudo in the Ubuntu help wiki.