If you have weak root password, and anything accesses it, you've just lost your PC. Not the hardware, but in theory not even a complete disk wipe followed by a reinstall will get you clean (there are at least concepts of infecting firmware, which would be easy with root access). More probably - you can get infected with ransomware or become part of botnet. That's for the risks.
Possible attack vectors: are you absolutely sure every program that you use has absolutely no remote code execution bugs? You know, there were remote code execution bugs in image handling code. That could get a bot that works on your local account and tries to crack root password. Or, if you run SSH server, expose it to the Internet and haven't blocked root login (I don't know if it's default in Ubuntu), than anyone can try remotely.
Next - how often do you type root password? Daily? Weekly? Every 5 minutes?
To be honest, you shouldn't be doing it very often. In fact, it's perfectly possible to use Ubuntu without even having a root password. By default Ubuntu uses sudo
. That adds to the problem, as now your own password has the value of the root's password.
Edit:
Remember that the fact you don't use server programs doesn't mean they aren't running. Ubuntu (actually Debian) has an IMHO insane policy that whenever you install a package that can run any type of server, it adds it to startup script and actually runs the software at the time of installation. It's insane, because it runs the software before you have any chance to configure it. The fact that you don't have a static IP is no blocker for random scanners - in fact my server gets more scans from random IP guessing than from the assigned DNS name. A NAT or firewall between you and the Internet would help a little (depending on how it's configured), but a public, non-static IP does not. It's not that anyone is trying to hack you specifically. It's just bots scanning whole address ranges for vulnerable machines. It doesn't matter if they try you at the beginning of the range or at middle.
The fact that you use only open source programs doesn't tell you use only secure programs. Open source only means that more eyes can more easily look at the code. It doesn't mean that more eyes really look at it, and it doesn't mean that the eyes that notice a bug are going to share it and possibly fix it. While my personal opinion is that FLOSS is more secure than proprietary software, it's only "more secure" and not "always secure".
By using a weak password you are essentially giving up on one layer of the defense in depth. If anyone can anywhere trick you into executing something or get a few bytes of buffer overflow to execute, you're toast, and you've just made it easier, because a strong password (root or your) could've slowed the attack enough that you notice something.
You have to weight the risk of loosing everything you have on that machine and opening access to any websites you routinely use on it (less probably any you ever use) against your convenience.
Disclaimer: I'm paranoid by choice.
su
to bruteforce the password. – André Borie Nov 26 '15 at 16:14ssh
, even if installed , are off by default. So if I don't use these programs, is it ok to have a weak root password? – kashish Nov 26 '15 at 16:23make sure you are not storing any valuable/sensitive/confidential information on such system.
. That's what I want to know. What can go wrong if I keep confidential information on such system? – kashish Nov 26 '15 at 16:59