I usually use Debian-derivative distributions such as Ubuntu server. Most of them come pre-configured to use sudo rather than su and to prevent access to the root account at all possible.

With this in mind, should root have a shell in /etc/passwd? If I cannot login as root, does it make sense to give root a real shell?

  • 2
    I'm not entirely sure but I think there's a fair chance that many cronscripts which run as root will break if they don't have a valid shell. – Teun Vink Dec 5 '13 at 6:00

Normally one would need a shell, e.g. when logging in directly on the console, or in single user mode. Install a test system in a virtual machine and try it out?

  • Whenever I've used single-user mode, I've specified the shell manually by adding it to the end of the boot command. Even if you set root's shell to false, or otherwise disable it, so that sudo -i and sudo su don't work, you can still use sudo -s to run your current shell as root. – paul sullivan Nov 12 '15 at 10:29
  • If you don't put a valid shell, mail to root@host bounces if you haven't forwarded it somewhere. This is a /bad/ thing. I would shudder to omit root's shell for other reasons too. – Joshua Sep 18 '16 at 23:41

In a perfect world you don't need a root shell. In a planned obsolescent society it depends how critical your up time is. If your backup system is very good, and you can wait while down restoring everything from it. then you can do without the shell. Murphy will ALWAYS rear his ugly head at the worst time. If YOUR account get scrambled then you can't use it's shell to run root in.

Now definitely BLOCK remote root access, unless you are putting the system in a very remote physical location. I had one headless server that only allowed root to log in through serial console. I kept an old 486 laptop just to let me plug in if needed. But you can and should tie the root shell to a specific console as well so it can't be running on other VC's.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.