GitLab

The way we disable the root account causes troubles with configuration of some packages, like gpsd:

Setting up gpsd (3.17-7) ...
Creating/updating gpsd user account...
Your account has expired; please contact your system administrator
chfn: PAM: Authentication failure
adduser: `/bin/chfn -f GPSD system user gpsd' returned error code 1. Exiting.
Non-system user gpsd found. I will not overwrite a non-system
user.  Remove the user and reinstall gpsd.
dpkg: error processing package gpsd (--configure):
 installed gpsd package post-installation script subprocess returned error exit status 1

gpsd's postinst script looks like this:

#!/bin/bash
# postinst script for gpsd

set -e

if [ "$1" = "configure" ] ; then

    echo "Creating/updating gpsd user account..."
    adduser --system --ingroup dialout --home /run/gpsd \
            --gecos "GPSD system user" --shell /bin/false \
            --quiet --disabled-password gpsd || {
        # adduser failed. Why?
        if getent passwd gpsd >/dev/null ; then
            echo "Non-system user gpsd found. I will not overwrite a non-system" >&2
            echo "user.  Remove the user and reinstall gpsd." >&2
            exit 1
        fi
        # unknown adduser error, simply exit
        exit 1
    }


fi

#DEBHELPER#

exit 0

It also causes some commonly used patterns, like sudo su, to not work. AFAIK other systems, like Ubuntu, tend to disable root account just by disabling its password without expiring the account.