Why does Ubuntu have a disabled root account?

Ubuntu disables root login for "security reasons". However it seems to me that it doesn't help with security at all.

If an intruder manages to get your login password for Ubuntu, then he also has the super-user password, since it's the same as the login password.

However if the root password is required, then just having the login won't help the intruder much - that's right isn't it?

So basically, what I want to know is: Why did Ubuntu choose to disable the root password? What are the security reasons?

Please don't answer according to what you "think" was the reason - I'm looking for an answer from official sources, or linked to them.

Mitch posted a good link in comment: Why is it bad to login as root? and the Debian site has the main benefits listed in their wiki:

Why sudo?

Using sudo is better (safer) than opening a session as root for a number of reasons, including:

• Nobody needs to know the root password (sudo prompts for the current user's password). Extra privileges can be granted to individual users temporarily, and then taken away without the need for a password change.

• It's easy to run only the commands that require special privileges via sudo; the rest of the time, you work as an unprivileged user, which reduces the damage that mistakes can cause.

• Auditing/logging: when a sudo command is executed, the original username and the command are logged.

For the reasons above, switching to root using sudo -i (or sudo su) is usually deprecated because it cancels the above features.

Regarding Ubuntu The benefits and disadvantages are listed on our wiki:

Benefits of using sudo

There are a number of benefits to Ubuntu leaving root logins disabled by default, including:

• The installer has fewer questions to ask. Users don't have to remember an extra password for occasional use (i.e. the root password). If they did, they'd be likely to forget it (or record it unsafely, allowing anyone to easily crack into their system).

• It avoids the "I can do anything" interactive login by default. You will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing.

• sudo adds a log entry of the command(s) run (in /var/log/auth.log). If you mess up, you can go back and see what commands were run.

• On a server, every cracker trying to brute-force their way in will know it has an account named root and will try that first. What they don't know is what the usernames of your other users are. Since the root account password is locked, this attack becomes essentially meaningless, since there is no password to crack or guess in the first place.

• Allows easy transfer for admin rights by adding and removing users from groups. When you use a single root password, the only way to de-authorize users is to change the root password.

• sudo can be setup with a much more fine-grained security policy. The root account password does not need to be shared with everybody who needs to perform some type of administrative task(s) on the system (see the previous bullet).

• The authentication automatically expires after a short time (which can be set to as little as desired or 0); so if you walk away from the terminal after running commands as root using sudo, you will not be leaving a root terminal open indefinitely.

Downsides of using sudo

Although for desktops the benefits of using sudo are great, there are possible issues which need to be noted:

• Redirecting the output of commands run with sudo requires a different approach. For instance consider sudo ls > /root/somefile will not work since it is the shell that tries to write to that file. You can use ls | sudo tee -a /root/somefile to append, or ls | sudo tee /root/somefile to overwrite contents. You could also pass the whole command to a shell process run under sudo to have the file written to with root permissions, such as sudo sh -c "ls > /root/somefile".

• In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to leave the system unusable unless cracked. An extra local user, or an enabled root password is needed here. The local user account should have its $HOME on a local disk, not on NFS (or any other networked filesystem), and a .profile/.bashrc that doesn't reference any files on NFS mounts. This is usually the case for root, but if adding a non-root rescue account, you will have to take these precautions manually. However the advantage of using a local user with sudo is that commands can be easily tracked, as mentioned in the benefits above.

And we always have had it (from the very 1st release).

Oldest reference I found speaks about 4.10 that has "sudo"

SHUTTLEWORTH LAUNCHES DEBIAN-BASED UBUNTU LINUX

... The Debian-based Ubuntu Linux includes Gnome 2.8, kernel 2.6.8.1, OpenOffice.org 1.1.2 and comes with a text-based, but easy, installation procedure. Ubuntu has disabled the root user preferring to use sudo much like Mac OSX does ...

I believe that what is written on the help page is clear enough and enough objective.

Ubuntu is "for everyone" and although if you are good enough you don't need root access to damage your computer, at the same time you don't need it almost at all (and you know how to easily enable it).
So the problem is not with people who are "good enough", but for everybody else, that may come to Linux from another world of computing and the first impact is with Ubuntu (and we are many).

If you are not an expert and don't know exactly what root is and how to properly handle it, you neither want nor need to have it enabled (and risk, for example, to do a graphic login with it).
It is much better to learn how to do things on the safe side and then move on to harder and more dangerous path, than start directly with the hard way and then damage your installation/workstation, get frustrated and maybe unable to recover a fully working system.
In general, to prevent is much better than to cure.