Why is using `sudo` safer than direct root login?

That's a very insightful question! While both sudo and a direct root login allow you to perform administrative tasks, sudo is considered much safer for several key reasons:

1. The "Safety Catch" Effect

When you are logged in directly as root, every command you type is executed with maximum privileges. If you accidentally type a destructive command (like deleting the wrong directory), the system will execute it immediately without warning.
With sudo, you only use administrative power for one specific command. This forces you to think for a split second before executing a high-risk action, acting like a safety catch on a tool.

2. Detailed Accountability (The Audit Trail)

In a professional environment where multiple people might manage a server:

• Direct root login: If someone deletes a file as root, the system logs show "root did it," but you don't know which person was using the root account.
• Using sudo: The system logs exactly which regular user ran which command (e.g., "User labex ran useradd as root"). This creates a clear "paper trail" or audit log.

3. Reduced Risk of "Staying in God Mode"

It is a common mistake to log in as root to fix one small thing, and then forget to log out. You might then continue checking emails or browsing files while still having total power, which is a major security risk. With sudo, your session remains a regular user session by default.

4. Protecting the Root Password

In many modern Linux systems (like the one you are using now), the root account doesn't even have a password set for logging in directly. By using sudo, you use your own user password to verify your identity. This means you don't have to share a single "Master Password" with every administrator on the system.

Summary:

• Root login is like walking around with a loaded gun with the safety off.
• sudo is like keeping the gun in a locked safe and only taking it out when you specifically need it for a task.

Ready to see what happened when you created that user? You can try the verification command from the lab:

sudo grep -w 'joker' /etc/passwd