Bug 1213159

Summary: [request] Lock root account by default
Product: [openSUSE] openSUSE Aeon Reporter: Milachew <milachew>
Component: BaseAssignee: Richard Brown <rbrown>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P3 - Medium CC: 0xdopice, alexander, stacheldrahtje
Version: Current   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Milachew 2023-07-09 07:58:43 UTC 
Since MicroOS aims to keep administration as small as possible, it makes sense to consider blocking root account by default.

Original comment: https://www.reddit.com/r/openSUSE/comments/14u7ka1/comment/jr60ogz/?utm_source=share&utm_medium=web2x&context=3


P.S. By the way, there have already been similar discussions, but regarding ALP: https://bugzilla.opensuse.org/show_bug.cgi?id=1203978
Comment 1 Richard Brown 2023-07-24 08:50:07 UTC 
Investigating
Comment 2 dopice 2023-08-02 07:18:38 UTC 
We cannot just look the root account since the default sudo configuration requires you to authenticate as root. If we want to lock the root account we also need to change the sudoers configuration, more exact remove or invert the statment 'Defaults targetpw'.

Maybe I'm stating the obvious here but I think it's good to keep it in this report as well.
Comment 3 Richard Brown 2023-09-06 14:41:00 UTC 
(In reply to dopice from comment #2)
> We cannot just look the root account since the default sudo configuration
> requires you to authenticate as root. If we want to lock the root account we
> also need to change the sudoers configuration, more exact remove or invert
> the statment 'Defaults targetpw'.
> 
> Maybe I'm stating the obvious here but I think it's good to keep it in this
> report as well.

Thanks for the obvious.. the implimentation in testing right now configures sudo for the wheel group and disables targetpw for the wheel group

I keep everything else as the default openSUSE config because a) I'm lazy and b) its easier if Aeon does its own thing without touching the universal defaults.
Comment 4 Richard Brown 2024-04-17 15:33:20 UTC 
Current prototype images don't have a root account set