12

The current defaults for the root account in /etc/passwd is root:x:0:0:root:/root:/bin/bash.

Why not set it to root:x:0:0:root:/root:/usr/sbin/nologin?

3
  • 7
    So that you can do sudo -i? – AlexP Jun 17 '18 at 13:11
  • 12
    "disables the root account" is a bit of a loose description: what it really disables is password-based authentication of the root account – steeldriver Jun 17 '18 at 13:18
  • 1
    @AlexP indeed I have just tested it, sudo -i does not work with root set to /usr/sbin/nologin. – loongyh Jun 17 '18 at 13:19
19

If that were the case, you would only be able to run commands with sudo one at a time, but you would not be able to start a root shell. A root shell is convenient in many cases, e.g. if you are planning to run multiple commands as root in a row.

Specifically, you could not run sudo -i, as AlexP noted. From man sudo:

-i, --login    Run the shell specified by the target user's password database entry as a login shell.
3
  • 7
    Doesn't sudo /bin/bash work to do that? – Federico Poloni Jun 17 '18 at 16:12
  • 5
    @FedericoPoloni that would be more like sudo -s I think (a root shell, but not a root login shell). It's a good point though - and in fact sudo -s does seem to work even when root's shell is /usr/sbin/nologin – steeldriver Jun 17 '18 at 16:17
  • 1
    You can disable -i, -s, /bin/bash, and so on by just allowing a whitelist of commands, see the documentation for the sudoers file. This is so fine grained, that it is for example possible to allow users to run /etc/init.d/someservice restart as root without allowing them to run /etc/init.d/someservice stop. But the ubuntu default is just to set no password for root and allow admin users to do everything with sudo. Probably the rationale is a) more than one admin user and b) The admin user does not need remember a second password for the root account. – allo Jun 18 '18 at 8:30
8

Besides Alberto Santini's sudo answer, there's another (far better) answer. If root's shell is set to something that is not a shell, booting single user doesn't work. There's recovery in sulogin for things like non-extant shell or completely broken shell, but it will not work if the shell appears to be a valid shell but isn't actually a shell.

You can still sudo directly to get a shell by specifying the shell to sudo so it's not even good protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.