5 Tips to protect the Root account

Protecting the Root account

Like systems running Windows have an account named Administrator, Unix systems have their equal named “root”. This user with user id zero (0), have unlimited access to the system. Most applications implementing user access controls, apply a “backdoor” to allow this root user always access. This applies to access data, killing processes, starting kernel modules and more.

Tips to protect the root user

Since the root user has unlimited access to the system, it make sense to protect this account carefully. Here are some tips..

1. Make it difficult

If you honestly care about your system security, then apply proper password rules to your root user account. Make sure it is long enough, have different character types and when possible even randomized.

2. Different password per system

You should avoid reusing passwords as much as possible. Especially with this administrative account, don’t repeat either.

3. Change it regularly

Use some tooling to change the password for each system on a regular basis. For example have one machine create random passwords, SSH into each machine and adjust the password. Then store the newly created passwords in a digital safe. Optionally with a hard-copy for you, or your manager.

4. Use need-to-know principle

Do really all system administrators need the root password for every machine? Or is it sufficient to apply a digital vault, in which a root password can only be accessed when really needed? If so, implement sudo and restrict passwords to a need-to-know basis.

5. Monitor misuse

People are lazy human beings. While you should be able to do your work activities, there is no excuse for compromising security just because it was “easier to work”. Monitor when and why the root user account is used.



One more thing...

Keep learning

So you are interested in Linux security? Join the Linux Security Expert training program, a practical and lab-based training ground. For those who want to become (or stay) a Linux security expert.

See training package

Lynis Enterprise screenshot to help with system hardeningSecurity scanning with Lynis and Lynis Enterprise

Run automated security scans and increase your defenses. Lynis is an open source security tool to perform in-depth audits. It helps with system hardening, vulnerability discovery, and compliance.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.