Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?

What should be done instead to alert the staff to the attempted instrusion?

  • 1
    Superuser should never be locked because an attacker trying to break in would result in locking himself out as well as the actual superuser/administrator who should not be denied access?
    – superfloyd
    Apr 25, 2012 at 19:31

2 Answers 2


Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect.

I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in.

To prevent from locking yourself out you can whitelist some IP's that will never get blocked.


Superuser on Unix/Linux aka. root shouldn't have a password in the first place or only be accepted from the physical console. Exactly for this reason. It is bad practice logging in as root, it is better to log in as a regular user and then sudo to root.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .