The Root Account¶

Mint doesn't give root a password; administrators use sudo. Debian usually does. Either way root is the one account that should never log in over the network or sit at an unlocked terminal, and the benchmark (CIS 5.3.2.4) accepts either state: a strong password, or locked.

Root's password¶

sudo passwd -S root

root L (locked) is the normal state on Mint. On Debian, root P is normal and the README will usually give you the password; keep it, change it if the README calls it weak, and make sure it can't be used over SSH (SSH). On Mint, root P means someone set a password; unless the README says root has one, lock it:

sudo passwd -l root

Locking root doesn't affect sudo -i, which is how you get a root shell when you need one.

Only one UID 0¶

awk -F: '$3 == 0 {print $1}' /etc/passwd

root only. Anything else is on the List and Compare page.

Root's shell and home¶

getent passwd root

Should be root:x:0:0:root:/root:/bin/bash. A different shell path is a planted binary. /root should be mode 700:

sudo chmod 700 /root

Console logins as root¶

/etc/securetty (if present) lists the terminals root may log in on; an empty file means none. On Mint the file doesn't exist and root is locked instead, which is enough. On Debian with a root password, the graphical login should refuse root: /etc/pam.d/gdm-password includes pam_succeed_if.so user != root quiet_success by default, and nothing in /etc/gdm3/custom.conf should allow root.

Restrict `su`¶

su lets anyone who knows root's password become root from any account. The benchmark (CIS 5.1.7) limits it to members of one group, normally an empty one, so sudo is the only road to root:

sudo groupadd sugroup
echo 'auth required pam_wheel.so use_uid group=sugroup' | sudo tee -a /etc/pam.d/su

After that, su - from a normal account fails with "Permission denied" even with the right password. If the README needs someone to use su, add them to sugroup.

Root's PATH and umask¶

Root's PATH (CIS 5.3.2.5) must not contain . or an empty entry (:: or a trailing :), and every directory in it must be owned by root and not writable by others. Otherwise a user can drop a fake ls somewhere root will find it first.

sudo -i sh -c 'echo $PATH' | tr ':' '\n'
for d in $(sudo -i sh -c 'echo $PATH' | tr ':' ' '); do stat -c '%a %U %n' "$d"; done

Root's own ~/.bashrc and ~/.profile shouldn't set a umask looser than 027 (5.3.2.6): sudo grep umask /root/.bashrc /root/.profile.

Verify¶

sudo passwd -S root
awk -F: '$3 == 0' /etc/passwd
stat -c %a /root

Example¶

sudo passwd -S root shows root P 08/14/2026. The README says administrators use sudo and doesn't mention a root password. sudo passwd -l root. stat -c %a /root shows 755; sudo chmod 700 /root.

Try it¶

Lock root, try su -, then sudo -i.
Add the pam_wheel line and try su from a normal account.

Build it¶

Add passwd -S root, the UID 0 check, and the PATH check to accounts.sh.

Next¶

Listening Ports