passwd -dl root
does not disable the root user. It removes and "locks" the password, i.e. it sets a meaningless password hash.
Having an account with a locked password means that you cannot log into the user using the password. su, login and lightdm won't allow you to login as root because, by default, they ask you the user's password.
However sudo works in a different way: roughly, it has a list of users that are allowed to run sudo (the users in this list are called sudoers) and, by default, asks for the password of the user has launched sudo.
This is why, using sudo, you can log in into root even if root doesn't have a password. If you try the command su root
, you'll see that you won't be able to log in, because it'll ask for a password that you can't provide.
su, login, lightdm, sudo, ssh and others are all programs that you can use to log in to a system as a user, but they handle authentication in different ways. It is important to not confuse the authentication method with the action of logging in.
As you might expect, the topic of authentication is pretty long and can be tricky. Explaining here all the authentication methods available and how to make use of them would be too difficult. Fortunately there's a tool that can give you more exhaustive answers: man, which surely you already know. You may be interested in reading:
man passwd
man su
man sudo
man login
In particular, man passwd
contains this paragraph which you might find interesting:
-l, --lock
Lock the password of the named account. This option disables a password by
changing it to a value which matches no possible encrypted value (it adds a
´!´ at the beginning of the password).
Note that this does not disable the account. The user may still be able to
login using another authentication token (e.g. an SSH key). To disable the
account, administrators should use usermod --expiredate 1 (this set the
account's expire date to Jan 2, 1970).
Users with a locked password are not allowed to change their password.
So, to actually disable the root user you should run usermod --expiredate 1 root
. While experimenting is always a good thing, remember that this command can be really dangerous and will make your box unusable. So, if you want to try it, be sure to know how to recover your system or (better) use a chroot/linux container/virtual machine/live CD/live USB.
That said, you'll notice that sometimes you will get a message like this:
Your account has expired; please contact your system administrator
su: Authentication failure
However, there are other ways to use expired accounts. For example, sudo ignores the expiration date of the destination user (but checks the expiration date of the sudoer). Also su ignores it, but only when run as root:
Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)
To really make a user inaccessible, you should deal with PAM. See man 7 pam
and its SEE ALSO section for more information.