I have a problem, why should root access only be provided from a login on the console, and why should a user be forced to use "su" command to perform system maintenance, rather than logging in?

you could login instead of using su. generally if i am at the console ill be logged in as a regular user and use my virtual terminals and login as root. if i am on my desktop its easier to have multiple ssh windows and using su for root privs.

why should only root perform system maintenance? well answer me this, do you want anyone other than YOU (if you are the admin) having so much control over your system? not to mention the power to take down your system or a mess of other things that you should NOT want to happen.

It is really a matter of best practices and proven methods. It goes without saying that root is dangerous.

That being said, there are other reasons as well. All systems have trails that leave fingerprints when we login. Some are so-so, some meet C2 compliance and try to afford an unalterable audit trail that can be used as evidence in a court of law. If a login starts with a general account, it is harder to hold people accountable for their actions.

UNIX as a whole still has a lot of growing up to do. OS390 and the like will never die until proven compartmentalized methods exits where the "all powerful root" doesn't rule. Trusted Solaris is a good step in that direction, but not allowing root to login directly is at least a start.

Is the system that you are speaking of a corporate piece of equipment?

Cheers,

Keith