I'm currently spitballing ideas for an Internet of Things device. It will be running Linux on a widely available development board, I'm not too concerned about physical security or the end user doing something bad to it however I'd like to secure it from botnets such as the mirai botnet.
For things such as the root user account, how should I secure it: should I use key based authentication or just a regular password? I want to be able to give end users access to the root user account upon request or provide it out of the box.
I don't want to have any extra user accounts or store any authentication details on my servers in case of a breach.