I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value.
I have added a separate administrator user. This user has an authorized key for SSH, no password access, and passwordless sudo.
I would like to remove any trace of the root password and lock the root user.
This can be done with
passwd -d root && passwd -l root. However, this leaves a window between the two operations for bad behavior. How can you take both actions in one step?
This is more of an academic question than a practical one. My solution is
sed -e -i -e 's/^root:\([^:]*\)\(.*\)$/root:!!\2/' /etc/shadow, but it feels like there should be a less error-prone, idempotent operation.