**Who are you worried about?**

Attacks from the Internet on e.g. SSH? You can [prevent them in SSH][1], or limit root logins to local TTYs. See the [Red Hat documentation for tips][2].

Attacks from family and friends? Then you should remember that `sudo` leaves your root account accessible without password for a few minutes, so they could `sudo su` and then `passwd`. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY *and* not to use `sudo` at all. Anything you type in your X11 session (the root password or your own with `sudo` or `gksudo` or `kdesu`) can be stolen by any (visible or not visible) process through the X API, and commands can then [trivially be injected in the terminal][3] with a root access. Keylogging the whole session is also trivial.

  [1]: http://askubuntu.com/questions/27559/how-do-i-disable-remote-ssh-login-as-root-from-a-server
  [2]: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s2-wstation-privileges-noroot.html
  [3]: http://mupuf.org/blog/2014/03/18/managing-auth-ui-in-linux/#4-threat-model