Debian Sudo Setup With or Without Root Password

During the installation of the Debian operating system, the setup of administrative rights and the sudo package depends entirely on whether a root password is provided during the setup wizard. Choosing to either create a root password or leave the field blank establishes two distinct security and administration models: traditional direct root authentication or delegation of root privileges through the sudo group.

Installing Without a Root Password

If you leave the root password field blank during the Debian installation process, the installer automatically adopts a sudo-centric administrative model:

Root Account Disabled: The actual root account is locked. In /etc/shadow, the password field for root is populated with an exclamation mark (!), preventing direct login as root either via the console, display manager, or SSH.
Sudo Installed and Configured: The installer ensures the sudo package is installed on the system.
User Added to the Sudo Group: The primary non-root user account created during the installation is automatically added to the sudo group. Members of this group have full administrative privileges to execute commands as superuser using their own user password.

This configuration mirrors the default behavior found in distributions like Ubuntu, ensuring a standard user can immediately manage system packages, services, and system configurations with commands such as sudo apt update.

Installing With a Root Password

If you enter a root password during the installation, Debian follows the traditional Unix administrative model:

Root Account Enabled: The root account remains active, and direct logins using the defined password are permitted on local consoles (and via SSH if configured).
No Default Sudo Rights for Users: The standard non-root user created during the installation is not added to the sudo group.
Sudo Status: Even if the sudo package is installed on the system as part of standard base packages, standard users cannot use it. Attempting to run a command prefixed with sudo will return the error: [username] is not in the sudoers file. This incident will be reported.

In this scenario, administrative commands must be executed by switching to the root user using the su - command and entering the root password.

Enabling Sudo After Setting a Root Password

If a root password was created during installation and you later decide to grant a standard user sudo access, you must manually configure it as root:

Switch to the superuser account:
```
su -
```
Ensure sudo is installed:
```
apt update && apt install sudo
```
Add your standard user to the sudo group:
```
usermod -aG sudo <username>
```
Log out and log back in with the standard user account for the group membership changes to take effect.