There are three different way to do this. We can use one of these methods to prevent root from access the system locally. But before that, it is important to create an admin user to reverse the process if needed.
- Locking the root user.
- Removing the password from the showpass file
- Changing the login shell to /sbin/nologin
- Locking the root user.
Before locking root, it is necessary to create an admin user, in case we need to rollback the process.
Let’s create admin user by adding an ordinary user to the wheel group.
[root@localhost ~]# useradd tom
[root@localhost ~]# passwd tom
Changing password for user tom.
New password:
BAD PASSWORD: The password is shorter than 8 characters
Retype new password:
passwd: all authentication tokens updated successfully.
[root@localhost ~]# id tom
uid=1001(tom) gid=1001(tom) groups=1001(tom)
Adding to wheel group
[root@localhost ~]# usermod -aG wheel tom
[root@localhost ~]# id tom
uid=1001(tom) gid=1001(tom) groups=1001(tom),10(wheel)
Locking the root user
usermod -L root
For unlocking, you will need access as the admin (tom) and issue the unlock command as follows:
sudo usermod -U root
Attempting to login will result in this screen.
2. Removing the password from shadow file
Now root cannot access the system by entering it’s username and password as before. To revert back to the previous settings, we need to access as a sudo user. There, you’ll have to assign a new password as below.
3. Changing the login shell to /sbin/nologin by editing the /etc/passwd file as below.
If you will need to reverse the process, login as sudo user and change back to login shell as “/bin/bash” as I have mentioned below.
My Linux NotePad 