I let the illiterates use it, but if they don't need root they don't get root. Debian stable with auto-unattend.