Root Use Guidelines

Restrict knowledge of the root password to the barest minimum number of people--one if possible. The root password should be held in strictest secrecy and changed periodically.

All root accounts should have PATH set (in .profile or .login) to some default that does not contain the current directory ("dot"). The following PATH is recommended: /bin:/usr/bin:/etc

Most system administration tasks should be performed by invoking SAM, because its menus restrict choices and thus reduces potential damage.

If the root user forgets the root password, reboot the system in single-user state, and reassign the password.

Superusers should construct at and cron jobs carefully. When at and cron are executed, the system searches the path set by root.

Set your file creation mask with a umask of 077 before creating a file. This restricts read and write permissions to the file owner by default.

Do not leave executables where they were developed. Restrict access to executables under development.