How to create extra root user?

Question

I have tried making a root2 user which should have the same permissions as root by doing

useradd -g root root2
passwd root2
usermod -G root root2
usermod -aG wheel root2

but root2 can still not cat /etc/shadow as an example.

How can I create such user?

Solution 1

You can't. root is a special user with uid 0. Use sudo instead.

Solution 2

Premise: using sudo (as suggested by the accepted answer) probably is the correct solution at your problem.

That said, if you really need something resembling a second root account, you can create an alias to the system root account.

To do that, follow these steps:

1. open /etc/passwd
2. locate the root account line (often the very first line). It will be something similar to root:x:0:0:root:/root:/bin/bash
3. copy/paste it changing the first root occurence in root2 (ie: changing it in root2:x:0:0:root:/root:/bin/bash)
4. save your changes and exit the text editor
5. issue passwd root2 and enter the new password

Note: if you whish, you can avoid direct editing the /etc/passwd file by replacing steps 1-3 with the following command: useradd -o -u 0 -g 0 -N -d /root/ -M root2 (see useradd --help for more information about the required options)

At this point, you can login using not only the original root account (with its original password), but also using the new root2 account (with its new password).

Anyway, remember that it is an alias of an existing user, rather than a completely new user. This means that any files created while logged as root2 have the very same numerical oid/gid of the original system root account (which has 0 as both uid and gid).

Solution 3

This used to be somewhat common (before sudo alleviated the need).

The toor user (yes, that's "root" spelled backwards) is the most common alternate root user, sharing the special UID of zero with root. See also this Super User question: Does the root account always have UID/GID 0?

This is the purpose of useradd --non-unique (useradd -o). I believe you want something like:

useradd --non-unique --uid 0 root2

You should be able to give the account any that doesn't already exist on your system.

I do not recommend this. You're far better off with one true root user, reserved for emergency console access. Admins should all instead use sudo. Especially remote admins (it is wise to prohibit root from connecting via ssh or other remote services, especially w.r.t. password logins).

Comments

[Jasmine Lognnes]

Interesting! With my above commands root2 have a GID of 0, how come that doesn't give the user full root privileges?

[dortegaoh]

because a GID is not a UID.

[Jasmine Lognnes]

So what does it give root2 to have GID of 0?

[FooBee]

Nothing that would give it real root permissions (aka is allowed to do everything). You can access files that are group-accessible for group root, but that's about it.

[dmourati]

You can in fact have multiple root users. Just use a text editor to change root2 uid to 0. tldp.org/LDP/LGNET/48/tag/16.html

[FooBee]

@dmourati: Yes, I know this but this will be essentially the same user, because the user id is the same and you might end up with some hard-to-understand side effects. Using sudo is simple and effective.