The current defaults for the root account in /etc/passwd is root:x:0:0:root:/root:/bin/bash.
Why not set it to root:x:0:0:root:/root:/usr/sbin/nologin?
If that were the case, you would only be able to run commands with sudo one at a time, but you would not be able to start a root shell.
A root shell is convenient in many cases, e.g. if you are planning to run multiple commands as root in a row.
Specifically, you could not run sudo -i, as AlexP noted. From man sudo:
-i, --login Run the shell specified by the target user's password database entry as a login shell.
-
7
-
5@FedericoPoloni that would be more like
sudo -sI think (a root shell, but not a root login shell). It's a good point though - and in factsudo -sdoes seem to work even when root's shell is/usr/sbin/nologin– steeldriver Jun 17 '18 at 16:17 -
1You can disable
-i,-s,/bin/bash, and so on by just allowing a whitelist of commands, see the documentation for the sudoers file. This is so fine grained, that it is for example possible to allow users to run/etc/init.d/someservice restartas root without allowing them to run/etc/init.d/someservice stop. But the ubuntu default is just to set no password forrootand allow admin users to do everything with sudo. Probably the rationale is a) more than one admin user and b) The admin user does not need remember a second password for the root account. – allo Jun 18 '18 at 8:30
Besides Alberto Santini's sudo answer, there's another (far better) answer. If root's shell is set to something that is not a shell, booting single user doesn't work. There's recovery in sulogin for things like non-extant shell or completely broken shell, but it will not work if the shell appears to be a valid shell but isn't actually a shell.
You can still sudo directly to get a shell by specifying the shell to sudo so it's not even good protection.
sudo -i? – AlexP Jun 17 '18 at 13:11