Speaking of which I do something cool with my main desktop (an AMD 7700X, but whatever). It's running Debian and there's zero executable with the suid bit set. There's no sudo command installed. Using "su" to su to root is technically possible but it's like a 40 characters long password, meant to never be entered (and I never ever entered it using su).

The only way I can get root (short of using a local privilege exploitation exploit to gain root) is by logging, using a Yubikey, over ssh, from a dedicated laptop that has nothing but a SSH client. So the Yubikey is plugged into the laptop.

That dedicated laptop has no wifi drivers and is on a dedicated LAN and that dedicated LAN only has two machines on it: my desktop and that laptop.

The laptop serves no purpose other than: "log in as root on the desktop".

Of course both that laptop and the desktop have firewalls.

This means, yes, I allow log in as root using SSH. But password logins are disabled and the only way to log in as root using SSH is to use the Yubikey. And the firewall only allow SSH attempts to port 22 from the MAC address, IP, and dedicated LAN that corresponds to the laptop.

In addition to that my main desktop has multiple user accounts: but none of those users are allowed to su or sudo.

Now, I know, I could use Qubes or whatever.

But what I explained above is how I do it: even myself I cannot get root on my own desktop without my laptop + Yubikey (I'd need to find and enter the 40 chars long root password).

When I really need to do something as root (and once becoming root becomes extremely hard, suddenly you realize how rare are the occasions when you really need to be root), I open my laptop and boot it (and because that laptop has no GUI and basically nothing besides a SSH client, it boots in three seconds or so).

Haters gonna hate but that's been working totally fine for me since years and years.