Disable Qubes Root Password

User Support General
1

When I installed Qubes, I set a root password. Was it a mistake and if yes how can I disable it again?

I found a lot of different opinions on this. The documentation says to leave root disabled. Some other posts say that it is “extra security” and others say that there is no benefit to being root in Qubes and that it does not matter. I have also heard that it is a security risk.

I am so confused :confused:

1 Like
2

I found the following commands

  1. Remove the root password:
    sudo passwd -d root
  2. Lock the account:
    sudo passwd -l root

Should I run them in the dom0 terminal? Sorry for the stupid questions btw. :laughing:

2 Likes
3

No need. Once an adversary is in dom0, it’s Game over, anyway…

2 Likes
4

So that means that it does not matter if an adversary has root or user access to dom0?

1 Like
5

Yes, all your data is in VMs accessible from dom0 without root.

3 Likes
6

Was the solution…

sudo passwd -d root

…or…

sudo passwd -l root

I want to make sure I return the system to its previous default because I am have had great difficulty accessing both my hard drive, and my usb sticks since mistakenly entering passwd without a user name.

I am hoping for some assurance before experimenting, since my backup is now out of date :worried:

1 Like
7

I just found that my SSD has enough vm-pool memory for me to make a new App VM with huge “private storage max size”, and that I can still backup to that.
I even remembered to exclude that VM from my backup.
I am therefore uploading my backup to Amazon S3, and unless anybody has any comments before it completes at around 10am GMT, I will try the…

sudo passwd -d root

… option.

1 Like
8

Neither: