Re: [OT] sudo: restrict to physical console only?

[Greg Wooledge <wooledg@eeg.ccf.org>]

On Tue, Aug 04, 2020 at 11:44:04AM +0200, Marco Möller wrote:
> As my root account is disabled, I do all administration as the "normal" user
> with the help of sudo for running administrative commands. The user "root"
> shall not login nowhere, not at the physical console and not by ssh, never.

Remember that this also means you can never boot in single-user ("rescue")
mode.  If you ever need to boot in quasi-rescue mode, you'll have to
go down even lower and override the init= kernel parameter.

If you don't know what that means, you should NOT be doing this.