Skip to main content

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) X application, and commands can then trivially be injected in the terminal with a root access. If you are connected to a SSH server and have enabled X forwarding, that server can also keylog you.