Installation on new hard disk

[p.H]

is it ok to create /boot partition at the first?

It has been reported that some broken UEFI firmwares may require that the EFI partition is first. But I have no such experience.
Also, a separate /boot is useless in most cases and may cause trouble if undersized.

[syntone]

In the installation step when installer asks to provide a name and password for the “root” account: is it better to leave them empty, so the user will be able to get root access?

[arzgi]

In the installation step when installer asks to provide a name and password for the “root” account: is it better to leave them empty, so the user will be able to get root access?

If you leave root password empty, the installer will configure sudo for the first user.

You can later add root account if you need.

[Head_on_a_Stick]

You don't need sudo for root access.

[CwF]

If you leave root password empty, the installer will configure sudo for the first user.

You can later add root account if you need.

You don't need sudo for root access.

Is there a chicken and egg here?

I wouldn't know since all my installations are years old, created with a root user, and have graduated through gksu, sudo, and now primarily pkexec.

While pkexec can be used and all of its extensive granularity can be set, it does require root to do so! Once done properly, no root account or sudo substitute is ever needed...

So for the first experience needing root access what is the answer?
1 - if the installer without a root account sets up the user with sudo - it's there already - why declare it not needed? It seems the official answer.
2 - If somehow no root or sudo, impossible? Or is the su always available?

My call is always create a root account on a personal machine. KISS. I prefer to do some things in a tty as root, and if you have the right stuff a complete root DE.

[Head_on_a_Stick]

is the su always available?

If a root password is entered during the installation then su is available, if no root password is entered then sudo is available for the first user that is created but su is not usable unless a password is set for the root account after installation (or if su is called with sudo but that's just silly).

[arzgi]

Well, I've not needed root after installer made that possible.

But different users have varying needs. there is no golden bullet.

[CwF]

Well, I've not needed root after installer made that possible.

You mean 'root proper'?! Using sudo is needing root access, yes? Same goes for a pkexec enabled action, that is needing root access also. Calling root something else doesn't count as not needing root in my book!

So 'sudo' may be the only universal solution without a root account. If pkexec set up some default actions for the first user it would then be the same, but incomplete and much clumsier.

So we hire Peter and fire Paul, to what end? gksu George still feels slighted!

[syntone]

the installer offers to choose to specify or skip root password, then what's the purpose of this option?

[CwF]

the purpose of this option?

Old argument. Some believe a root account is a security risk. No account, no risk, aka android. There is an obvious logic there true, but it's simpleton logic. Rootless devices are security by obfuscation. The argument should include the intended audience but often doesn't. A personal builder appreciates a root account and that is a minority. A company selling something with an OS would prefer that OS not be easily breakable since they are responsible for support, a majority view overall.

So it's good Debian still offers the choice. It's a good idea to have a trail or log of privileged use rather than the open access of root. It seems every non-root get it done solution has it's own issues, but in a production machine with many users most admins want to keep track somehow, so there is a push to go rootless and use a method to log and track instead of allow anything goes root.

The point forgot by most is the idea of a target. Linux as a personal system is safer than most not because of some technical superiority but because we're not a big target. Windows has the image of weak security because it was the biggest target, until android.