linux system-management

Root User

root superuser linux permissions security
Plain English

Root is the all-powerful administrator account on Linux. It can read any file, change any setting, and delete anything, including the operating system itself. Because one wrong command as root can wreck a system, everyday work is done as a normal user, and admin commands are run one at a time with sudo.

Technical Definition

The root user (superuser) is the account with UID 0. The kernel skips most permission checks for UID 0, which is why root can read any file and kill any process.

On Ubuntu:

  • The root account exists but has no password set (locked), so you cannot log in as root directly
  • Admin access goes through sudo for members of the sudo group
  • sudo -i gives a root shell when you need several commands in a row

How to tell you are root: the prompt ends in # instead of $, and id -u prints 0.

Root’s home is /root, not /home/root.

Capabilities: Linux splits root’s power into capabilities (CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, and others) so services can get only what they need instead of full root.

Security practice:

  • Disable root login over SSH (PermitRootLogin no in sshd_config)
  • Run services as dedicated unprivileged users
  • Audit sudo use instead of sharing a root password
  • Treat any unexpected UID 0 account in /etc/passwd as a compromise indicator

Source: Ubuntu Server docs: User management

Working with root safely 

# Normal user vs root
$ id
uid=1000(george) gid=1000(george) groups=1000(george),27(sudo)
$ sudo id
uid=0(root) gid=0(root) groups=0(root)

# Root shell (note the # prompt), then leave it
$ sudo -i
root@lab:~# exit

# Any other UID 0 accounts? There should be one line
$ awk -F: '$3 == 0' /etc/passwd
root:x:0:0:root:/root:/bin/bash

# Is root login over SSH disabled?
$ sudo sshd -T | grep permitrootlogin
In the Wild

Root access is the prize in most Linux attacks, which is why privilege escalation is a whole category of security work. In daily admin work, stay as your own user and use sudo per command, so mistakes are smaller and actions are logged under your name. If you find yourself in a root shell, finish the task and exit. On servers, root SSH login off and key-only authentication are baseline hardening.

← Back to Dictionary