4

So if I disable my root account with sudo passwd -dl root I still have access to sudo {su,bash} or sudo -{s,i} conceptually how are the elavated rights different from the root account?

I know the difference between each of the elevations, or shells, I'm looking for an in-depth difference between an account and elevated rights?

1
  • SUDO isn't really different, it just acts differently. Instead of permanently gaining Root access in an Account or Terminal, only the single command you issue is given Root Privileges. It's as much a Security Feature as it is a Safety Feature.
    – japzone
    Dec 4, 2012 at 15:19

2 Answers 2

4

There is no difference. sudo changes your user id to root, without regard for whether or not the root account has a password.

The difference between sudo -s and sudo -i is whether or not the environment variables ( things like $HOME ) are kept at your current values ( so ~ still points to your home directory ) or are reset to the values root would get if he logged in normally.

3

passwd -dl root does not disable the root user. It removes and "locks" the password, i.e. it sets a meaningless password hash.

Having an account with a locked password means that you cannot log into the user using the password. su, login and lightdm won't allow you to login as root because, by default, they ask you the user's password.

However sudo works in a different way: roughly, it has a list of users that are allowed to run sudo (the users in this list are called sudoers) and, by default, asks for the password of the user has launched sudo.

This is why, using sudo, you can log in into root even if root doesn't have a password. If you try the command su root, you'll see that you won't be able to log in, because it'll ask for a password that you can't provide.

su, login, lightdm, sudo, ssh and others are all programs that you can use to log in to a system as a user, but they handle authentication in different ways. It is important to not confuse the authentication method with the action of logging in.

As you might expect, the topic of authentication is pretty long and can be tricky. Explaining here all the authentication methods available and how to make use of them would be too difficult. Fortunately there's a tool that can give you more exhaustive answers: man, which surely you already know. You may be interested in reading:

  • man passwd
  • man su
  • man sudo
  • man login

In particular, man passwd contains this paragraph which you might find interesting:

   -l, --lock
       Lock the password of the named account. This option disables a password by
       changing it to a value which matches no possible encrypted value (it adds a
       ´!´ at the beginning of the password).

       Note that this does not disable the account. The user may still be able to
       login using another authentication token (e.g. an SSH key). To disable the
       account, administrators should use usermod --expiredate 1 (this set the
       account's expire date to Jan 2, 1970).

       Users with a locked password are not allowed to change their password.

So, to actually disable the root user you should run usermod --expiredate 1 root. While experimenting is always a good thing, remember that this command can be really dangerous and will make your box unusable. So, if you want to try it, be sure to know how to recover your system or (better) use a chroot/linux container/virtual machine/live CD/live USB.

That said, you'll notice that sometimes you will get a message like this:

Your account has expired; please contact your system administrator
su: Authentication failure

However, there are other ways to use expired accounts. For example, sudo ignores the expiration date of the destination user (but checks the expiration date of the sudoer). Also su ignores it, but only when run as root:

Your account has expired; please contact your system administrator
su: Authentication failure
(Ignored)

To really make a user inaccessible, you should deal with PAM. See man 7 pam and its SEE ALSO section for more information.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .