Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?

What should be done instead to alert the staff to the attempted instrusion?

share|improve this question
Superuser should never be locked because an attacker trying to break in would result in locking himself out as well as the actual superuser/administrator who should not be denied access? – superfloyd Apr 25 '12 at 19:31

Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect.

I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in.

To prevent from locking yourself out you can whitelist some IP's that will never get blocked.

share|improve this answer
thanks very much – superfloyd Apr 25 '12 at 19:30

Superuser on Unix/Linux aka. root shouldn't have a password in the first place or only be accepted from the physical console. Exactly for this reason. It is bad practice logging in as root, it is better to log in as a regular user and then sudo to root.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.