"Some hosting providers has insecure server images. E.g. Ubuntu where the root user has no password, since, as they might argue: "you login with key file on SSH

"Some hosting providers has insecure server images. E.g. Ubuntu where the root user has no password, since, as they might argue: "you login with key file on SSH anyway"" Ubuntu is not insecure regarding root user access. Reference https://discourse.ubuntu.com/t/security-users/11881 https://discourse.ubuntu.com/t/security-users/11881 "This does not mean that the root account has been deleted or that it may not be accessed. It merely has been given a password hash which matches no possible value, therefore may not log in directly by itself."