2

I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible.

With this in mind, should root have a shell in /etc/passwd? If I cannot login as root, does it make sense to give root a real shell?

Improve this question
1
  • 2
    I'm not entirely sure but I think there's a fair chance that many cronscripts which run as root will break if they don't have a valid shell.
    – Teun Vink
    Dec 5, 2013 at 6:00

2 Answers 2

Reset to default
1

Normally one would need a shell, e.g. when logging in directly on the console, or in single user mode. Install a test system in a virtual machine and try it out?

Improve this answer
2
  • Whenever I've used single-user mode, I've specified the shell manually by adding it to the end of the boot command. Even if you set root's shell to false, or otherwise disable it, so that sudo -i and sudo su don't work, you can still use sudo -s to run your current shell as root.
    – paul sullivan
    Nov 12, 2015 at 10:29
  • If you don't put a valid shell, mail to root@host bounces if you haven't forwarded it somewhere. This is a /bad/ thing. I would shudder to omit root's shell for other reasons too.
    – Joshua
    Sep 18, 2016 at 23:41
0

In a perfect world you don't need a root shell. In a planned obsolescent society it depends how critical your up time is. If your backup system is very good, and you can wait while down restoring everything from it. then you can do without the shell. Murphy will ALWAYS rear his ugly head at the worst time. If YOUR account get scrambled then you can't use it's shell to run root in.

Now definitely BLOCK remote root access, unless you are putting the system in a very remote physical location. I had one headless server that only allowed root to log in through serial console. I kept an old 486 laptop just to let me plug in if needed. But you can and should tie the root shell to a specific console as well so it can't be running on other VC's.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .