Currently after setup-webconf run you need to access acf web site to setup root password during first time log-on. Here is a security issue if somebody else will access your site without authorization first. I suggest to ask for root password ans setup it in setup-webconf script.

(from redmine: issue id 142, created on 2009-08-19, closed on 2009-08-20)