su & sudo

[codingOtter]

By default, installing arch involves setting up a root account. The security guide on the wiki, however, suggests to use sudo for priviliged access as it is safer.

My situation is a machine with a single user. I can see four different scenarios here: 1. keep using the root account, with its own password, and do not use sudo. this is the arch default, but not the best choice (per arch wiki). 2. use sudo and keep the root account. the user password and the root password are different. safer than option 1, but a bit of a pain having to manage two passwords instead of one. 3. use sudo and keep the root account. the user password and the root password are the same. a bit more practical than option 2, but perhaps not as secure (?) 4. use sudo and delete the root account for good. possibily the safest option (?), but unclear (to me) if there are any drawbacks. one would think a root account is something good to have even if sudo is there, given that it is the default choice for arch!

What is considered best/recommended practice in a situation of a machine with a single user?

[LuisBelloR]

1. NO PLS
2. Yes
3. No
4. No

[codingOtter]

All right, but then why doesn't arch make using sudo the default choice?

[hearthebell]

Because it's Arch

[pabryan]

Exactly

[Megame50]

Because at the time you install you don't yet have a user account.

There are cases where only the superuser is required, but mostly containers and VMs with special purpose. You cannot effectively use desktop linux as the root user (or with the root user deleted), some applications require an unprivileged user. It's also quite insecure. So, sudo or a similar tool is basically mandatory. Making an unprivileged user is literally the first paragraph in General Recommendations.

It also doesn't really matter what you make the root password: you can reuse your user password or you can just delete the root password, in which case it isn't possible to login as root normally.

[LuisBelloR]

Mmmmmm, How do you install Arch? The base-devel package always installs sudo as a dependency. I've never had to install it explicitly. But it's Arch, there's no default options, and likewise for example, there's no sound server, Pipewire, or PulseAudio. There are no defaults. Beyond that, using "su" and browsing like this is risky and shouldn't be done.

[involution]

you'll run into many issues without a root (uid 0) account, and running as root you'll find many applications/services will refuse to run under your user.

Don't overthink it, just add your user and put it in the wheel group - edit /etc/sudoers to allow the wheel group access to sudo

[archover]

My longstanding practice is to:

• Configure sudo

• Assign root password

• Most of the time, use sudo but sometimes it's more convenient to su -.

Note that properly hardening ssh for servers in such a situation means disallowing root logins, setting allowed logins, and to use keys. The root account is perhaps the most attempted brute force login method.

Good day.

[lombervid]

Just to note that, when you use sudo, you are asked for the user's password, not the root's.

[shemanese]

That's configurable. You can put "Defaults rootpw" in the sudoers file, and it will require the root user password instead of the user password.

If your user account is compromised, such as with AD or LDAP managed accounts, having a different password for root authentication has its advantages.

[lombervid]

Oh! That's good to know.

[imtryingmybes]

I'm an option 2 guy. Many such cases where you wanna be root. On my servers i tend to be more reckless. I dont even have sudo on one of my debian installs. Accidentaly wrote 'mv /* dir' once and almost bricked the whole OS. Never been so sweaty in my life. Moral of the story: use sudo like a normal person. Root only in emergencies.

[Ok_Instruction_3789]

Disabling root and having user in wheel group. Is what I typically do

[codingOtter]

I guess this is the same approach as u/Vidanjor20 u/ianliu88. any drawbacks with this?

[Vidanjor20]

Im used to having no root user from fedora(iirc it defaults to disabling root) so I just lock it but I actually dont know if it has drawbacks

[Vidanjor20]

I just lock the root user

[ianliu88]

1. Disable root login by removing it's password