lock root account via setting an invalid password

http/install-common.sh

@@ -94,6 +94,9 @@ sed -i -e 's/^GRUB_TIMEOUT=.*$/GRUB_TIMEOUT=1/' /etc/default/grub
 sed -i -e 's/^GRUB_CMDLINE_LINUX=.*$/GRUB_CMDLINE_LINUX="net.ifnames=0"/' /etc/default/grub
 grub-mkconfig -o /boot/grub/grub.cfg
 
+# lock root account
+usermod -p "*" root
+
 if declare -f post >/dev/null; then
   post
 fi