\section{The root Account}
\begin{frame}
   {The root Account}

   Use of the root account should be a rare exception
   \begin{itemize}
      \item Only log in as root when absolutely necessary
      \begin{itemize}
         \item Avoid mistakes
         \item Avoid potential security vulnerabilities
      \end{itemize}
      \item Require use of \textbf{su} to acquire root privilege
      \begin{itemize}
         \item Disallow direct root logins
         \item Set up an audit trail of who became root
      \end{itemize}
      \item For greater security use \textbf{sudo}
   \end{itemize}

\end{frame}

\cprotect\note{

   The root account should only be used for administrative
   purposes when absolutely necessary and never used as a
   regular account.  Mistakes can be very costly, both for
   integrity and stability, and system security.

   By default, root logins through the network are
   generally prohibited for security reasons. One can
   permit \textbf{Secure Shell} logins using \textbf{ssh},
   which is configured with
   \filelink{/etc/ssh/sshd_config}, and \textbf{PAM}
   (Pluggable Authentication Modules), through the
   \url{pam_securetty.so} module and the associated
   \filelink{/etc/securetty} file. Root login is permitted
   only from the devices listed in
   \filelink{/etc/securetty}.

   It is generally recommended that all root access be
   through \textbf{su}, or \textbf{sudo} (causing an audit
   trail of all root access through \textbf{sudo}). Note
   some distributions (such as \textbf{Ubuntu}), by
   default actually prohibit logging in directly to the
   root account.

   \textbf{PAM} can also be used to restrict which users
   are allowed to \textbf{su} to root.  It might also be
   worth it to configure \textbf{auditd} to log all
   commands executed as root.

}




