I always enable the root user and set a secure password as one of the first configuration stages on any new system. Then I immediately disable the root account. That way there's a non-default password required for any root account use, and with the account disabled by default it is the most secure possible arrangement. If any non-root account is compromised, the intruder would still have to guess or subvert a secure root password, instead of finding a password-less root account.

[ Reply to This | # ]

I'm fairly sure OS X uses the standard Unix method of setting the encrypted password to something that can never be produced by crypt(), so that no password can ever match. If that's so, you don't need to bother...

While I'm here, does anyone know how to change root's shell? chsh lets me change it to /bin/zsh, but when I run sudo -s, I still get bash. I hate bash :(

[ Reply to This | # ]