Lock the root account password

Description

The root account password must be locked to prevent direct password authentication as root. Administrative access is obtained by authenticating as an individual user and escalating privileges via sudo.

Rationale

A locked root password removes the highest-privilege account as a direct authentication target and enforces individual accountability: administrators must log in as themselves and escalate via sudo, so every privileged action is attributable. A password-authenticable root account is a single high-value credential exposed to brute force and shared use.

Framework references

Live verification