Renaming root account...

[Paul F. Bennett]

Our security group would like use to rename our HPUX systems root account (username), I don’t think this is possible but if I create another account with full-root privileges and disable the root what type of problem will/may I encounter?

[Pete Randall · Accepted solution]

Larry, Curly and Moe can all be root equivalents, simply by assigning them uid zero. However, this is something that is usually frowned by security folks because you will have no chance of auditing who did what to your system.

I also would not want to remove the root account itself. How would you reboot into single user mode to fix a problem if there was no root account?


Pete

[James R. Ferguson]

Hi Paul:

Don't. While privilege is conferred when the 'uid' (or 'euid') is zero, the name 'root' is also commonly evaluated in code.

Regards!

...JRF...

[James R. Ferguson]

Hi (again) Paul:

...AND...if you create other accounts with a uid=0 and you or someone will one day forget what they are and do something stupid (!) like:

# find / -user something -exec rm -rf {} +

...NOW consider that UNIX knows the account "something" only by number, and the number was ZERO (0) just as if you typed "root" in lieu of the account "something". A dead server is what you would have.

Regards!

...JRF...

[A. Clay Stephenson]

Your security group is populated with Windows experts; any user with a UID of zero (and there can be n) will have super-user status. However, many, many scripts and applications actually look for "root" so I can almost guarantee a partially broken box if you change "root" to "toor". Now it is possible to have a system where no one knows the root password (it can even be changed randomly every hour or so) and yet have root access for those who should have it. That is a perfect use of sudo.

[DCE]

Rather than disable root, restrict it to console only, and install sudo for those people who need root level access - that way you at least have an audit trail

[Anshumali]

Agreed with Clay. In windows, renaming a Administrator( read root ) account doesnt cause much trouble and your security auditors might be having the same idea here. Root account renaming and even shell changes may be serious issues on the server.
Having another people as UID 0 is dangerous and should be avoided.
Root access can be restriced to console using /etc/securetty and i hope even IP restrictions can be placed for root logins using SSH.
If you need to grant other user as root privileges, you may use sticky bits(think always twice), sam -r (If the user work is possible with SAM kind of menus.)
and the best will be sudo ( You will know what is configured and a logging will be available) but in no case....... UID 0 should be duplicated.............