Understanding when to use root

In the last chapter, we set up our very own Ubuntu Server installation. During the installation process, we were instructed to create a user account as an administrator of the system. So, at this point, we should have two users on our server. We have the aforementioned administrative user, as well as root. We can certainly create additional user accounts with varying levels of access (and we will do so in this chapter), but before we get to that, some discussion is in order regarding the administrator account you created, as well as the root user that was created for you.

In regards to root, the root user account exists on all Linux distributions and is the most powerful user account on the planet. The root user account can be used to do anything, and I do mean anything. Want to use root to create files and directories virtually anywhere on the file-system? No problem. Want to use root to install software? Again, not a problem. The root account can even be used to destroy your entire installation with one typo or ill-conceived command. Even if you instruct root to delete all files on your entire hard disk, it won't hesitate to do so. It's always assumed on a Linux system that if you are using root, you are doing so because you know what you are doing. So there's often not so much as a confirmation prompt while executing any command as root. It will simply do as instructed, for better or worse.

It's for this reason that every Linux distribution I've ever used instructs, or at least highly recommends, you to create a standard user during the installation process. It's generally recommended that you not use the root account unless you absolutely have to. It's common in the Linux community for an administrator to have his or her own account and then switch to root whenever a task comes up that requires root privileges to complete. It's less likely to accidentally destroy your server with an accidental typo or bad command while you're not logged in as root. Don't get me wrong, some arrogant administrators will strictly use root at all times without any issue, but again, it's recommended to use root only when you have to. And besides, when it comes to arrogant administrators, don't be that person.

Most distributions ask you to create a root password during installation in order to protect that account. Ubuntu Server is a bit different in this regard, however. You weren't even asked what you wanted the root password to be. The reason for this is because Ubuntu defaults to locking out the root account altogether. This is very much unlike many other distributions. In fact, Debian (on which Ubuntu is based), even has you set a root password during installation. Ubuntu just decides to do things a little bit differently. There's nothing stopping you from enabling root, or switching to the root user after you log in. Being disabled by default just means the root account isn't as easily accessible as it normally would be. I'll cover how to enable this account later in this chapter, should you feel the need to do so.

Note

An exception to this rule is that most VPS providers, such as Linode or DigitalOcean, will enable the root account even on their Ubuntu servers. Typically the root password will be randomly generated and emailed to you.

Instead, Ubuntu (as well as its server version), recommends the use of sudo rather than using root outright. I'll go over how to manage sudo later on in this chapter, but for now, just keep in mind that the purpose of sudo is to enable you to use your user account to do things that normally only root would've been able to do. For example, you cannot issue a command such as the following to install a software package as a normal user:

apt-get install tmux

Instead, you'll receive an error:

E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?

But if you prefix the command with sudo (assuming your user account has access to it), the command will work just fine:

# sudo apt-get install tmux

When you use sudo, you'll be asked for your user's password for confirmation, and then the command will execute. Understanding this should clarify the usefulness of the user account you created during installation. I referred to this user as an administrative account earlier, but all it really is is a user account that is able to utilize sudo. (Ubuntu Server automatically gives the first user account you create during installation access to sudo). The intent is that you'll use that account for administering the system, rather than root. When you create additional user accounts, they will not have access to sudo by default, unless you explicitly grant it to them.