I think a LDAP/LDAP+Kerberos backend is more secure for user accounts but I'd agree that the root password doesn't belong in it. But personally I think disablin

I think a LDAP/LDAP+Kerberos backend is more secure for user accounts but I'd agree that the root password doesn't belong in it. But personally I think disabling the root account (like OS X or Ubuntu) makes the most security sense. You can always get into the account in single user mode.