[SOLVED] How to set up a separate password for root?

[taxpayer]

I like to use a simple password for my user account, but when I need root access I want a more complex password. Back in the old days (Mepis) we had a separate root account but apparently this isn't done any more. I know that at least one other distro does allow a separate password for root in the same account. What is the practical way to accomplish this with kubuntu?

[rab0171610]

sudo passwd

This will ask you to enter a password and again to verify. You can then use su in the terminal and enter that password to get a root (#) prompt. If you want to change the password at any time, use the command above and enter a new password when prompted.
I LOVED Mepis, what a great distro it was in those days!

[claydoh]

allow a separate password for root in the same account.

Actually, 'root' is a separate account, not al all related to another user account.

if you remove your user account from the 'sudo' group, so that your simpler password is not used with admin, root level privileges to make things more secure, you will need to switch to the root account in the terminal, for command line items. For GUI password prompts, to save system level files edited with Kwrite, or to use Partition Manager, for example, this iirc will no longer work



https://help.ubuntu.com/community/Ro...r_root_account



A potential way to do this that preserves the GUI password admin functionality is to first create a new user account, (NOT named root ) and make sure it is set as an Administrator account.
Then, set your account as a Standard user, which takes it out of the sudo group. Reboot.

This should allow for working sudo password prompts in the GUI, and in the terminal one would have to switch to the admin account su - AdminUserName
Now, this still entails using the sudo command as per usual, while logged in to the terminal as that new username. So it may a bit clunky imo. But arguably more secure, and not prone to breaking things like enabling the root account will be

[taxpayer]

sudo passwd

This will ask you to enter a password and again to verify. You can then use su in the terminal and enter that password to get a root (#) prompt. If you want to change the password at any time, use the command above and enter a new password when prompted.

Even before I posted my query here, I had seen this idea pertaining to an old version of ubuntu, tried it without success. At your suggestion, I tried it again. Both on the command prompt and on Discover, the new password that I'd entered does not work, and I had to use the old, user password. I wonder if I need to set something else, somewhere, to allow the change to take effect?

[taxpayer]

A potential way to do this that preserves the GUI password admin functionality is to first create a new user account, (NOT named root ) and make sure it is set as an Administrator account.
Then, set your account as a Standard user, which takes it out of the sudo group. Reboot.

This should allow for working sudo password prompts in the GUI, and in the terminal one would have to switch to the admin account su - AdminUserName
Now, this still entails using the sudo command as per usual, while logged in to the terminal as that new username. So it may a bit clunky imo. But arguably more secure, and not prone to breaking things like enabling the root account will be

That seems like it's going to work, thanks. Tho it is clunky. Seems like there ought to be a way to just set a different password when root functions are needed.
I'll be playing with this a bit (on my laptop) and probably set things up that way on my main desktop computer when I install Kubuntu. I'll be around here asking more questions as issues arise.
Part of the reason I'm looking forward to Kubuntu is that there seems to be a large, helpful community.
I wonder how I would mark this one "solved?"

[rab0171610]

Both on the command prompt and on Discover, the new password that I'd entered does not work, and I had to use the old, user password.

It works fine for me. It doesn't give you access to Discover. It does not take the place of your password that you use with sudo. All it does is allow you to use the command "su" or "su root" in the terminal. You would then have a password that will give you a root prompt. If you need something other than a root prompt in a terminal then claydoh has got you covered. I must have misunderstood your original post.
Note that setting a root password works, but is not as safe as sudo. I only use it when I am working in a virtual terminal (no desktop) for administrative things and need a root prompt for convenience. Or when sudo does not give me permission, like trying to look at EFI directory with the ls command in the terminal. I do not recommend it for the average user or those who do not have good backups to fix a mistake.

[jlittle]

... the new password that I'd entered does not work...

I suspect you're giving the root password to sudo; that shouldn't work. If you really want to use the root password, su - does that, perhaps in the form su root -lc to get a drop-in replacement for sudo. If you want to run a GUI, use plain su (with its security problems), or on X11 one has to pass DISPLAY and XAUTHORITY. For example, I can run gparted with

su root -w DISPLAY,XAUTHORITY -lc gparted

(I've no idea how to run a GUI app with su with Wayland, if it is possible.)

In Ubuntu's early years, if not from its beginning, root logins were disabled, provoking lengthy, and often heated, discussions, especially by those used to logging in as root. And ever since, the controversy resurfaces occasionally.

[rab0171610]

I assume that the OP wants a different password than the regular user account for administrative tasks that require elevated privileges. Generally, this is no longer how altered/elevated privileges work, esp with GUI programs that rely on sudo frontends for privileges (gksudo, kdesudo, etc). Currently sudo accepts the users personal password for privilege mainly because of how the sudo command operates with regards to the password constraints. From the Wikipedia entry for sudo:

Unlike the command su, users supply their personal password to sudo . . . rather than that of the superuser or other account. This allows authorized users to exercise altered privileges without compromising the secrecy of the other account's password. After authentication, and if the configuration file permits the user access, the system invokes the requested command. sudo retains the user's invocation rights through a grace period (typically 5 minutes) per pseudo terminal, allowing the user to execute several successive commands as the requested user without having to provide a password again.

My suggestion is to accept using sudo with the personal password designation for GUI programs that require elevated privileges. If, and only if, you know what you are doing and can trust yourself with a root prompt in the terminal, then you can use su for non-graphical related terminal tasks.

Note that it still may be possible to run GUI programs with root privileges using one of the su front ends like kdesu or gksu, if that is even an option anymore. Whether or not that will allow you to use a different password for elevated privileges I do not know for sure as I have no practical experience with either. Feel free to research it.

[Snowhog]

I wonder how I would mark this one "solved?"

Just return to the first post, click on Edit and select [SOLVED] from the drop down list left of the Title.

[taxpayer]

Just return to the first post, click on Edit and select [SOLVED] from the drop down list left of the Title.

Thanks for that. I've put this root password problem aside for the moment, as Kubuntu is providing me more serious challenges about which I shall post separately.