Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I recently installed Debian in VirtualBox. During install there's a section where you can make a password for the root account but if you leave it blank, it instead gives your regular user sudo ability.
Ubuntu and some other distros allow sudo by default. Is there a problem to only using sudo and never using su?
This topic has been beaten to death, I suggest reading up on it. My opinion:
On a multi-user system, sudo is a very powerful tool. It's designed to allow SPECIFIC users to run SPECIFIC commands without requiring root access. This has the overall effect of increasing security since it means the master root password is in fewer hands and accessed less often. The system admin simply needs to ensure that only those commands that are truly necessary for a user to do their job AND are low-risk are handed out, and that those users have secure passwords.
On a multi-user system, handing out unlimited sudo access to any regular user is a BAD idea. Many of the protections that are put in place to keep a system from being compromised, such as preventing ssh access to the root account, are voided. In addition, since it's a regular user account with a password that needs to be entered on a semi-regular basis, chances are the password will be less complex, possibly even written down on a scrap of paper on the person's desk, re-used across the network, used on websites that could be compromised, etc. It opens up the system to a multitude of attack vectors.
On a single-user system, one might make the argument that having a dedicated root account is just a waste of time, but I still feel that granting any regular user unlimited sudo access is a mistake for the reasons mentioned above, and I do not do it on any of my systems. Even on Ubuntu/Mint, the first thing I do is enable the root account and shut off sudo access for my personal account.
I hope that's a qualified "No" since "su" has switch options that sudo does not, afaik.
The only one I see in su(1) without an equivalent in sudo(8) is --fast, which seems of pretty marginal utility. Possibly also --session-command, though I'm not entirely sure what that does.
Code:
-f, --fast
pass -f to the shell (for csh or tcsh)
--session-command=COMMAND
pass a single COMMAND to the shell with -c and do not create a new session
In way-too-many systems (and, every Macintosh ...), "administrative" users are members of the wheel group, and are able to issue the command sudo su to gain root-level privileges using their own(!) passwords.
Lesson: "leave your Superman suit in the closet!" Unless you are actively performing system maintenance, do not log in to any account that is capable of issuing this command. Your "ordinary, day-to-day" account should be non-privileged.
Last edited by sundialsvcs; 04-27-2016 at 07:27 PM.
The only one I see in su(1) without an equivalent in sudo(8) is --fast, which seems of pretty marginal utility. Possibly also --session-command, though I'm not entirely sure what that does.
Code:
-f, --fast
pass -f to the shell (for csh or tcsh)
--session-command=COMMAND
pass a single COMMAND to the shell with -c and do not create a new session
AFAIK although the same or similar switches are listed the manner in which they actually function can be very different since sudo is always governed by rule sets in suduoers.conf. Also if I invoke "su -i" I become root including with .profile with complete $PATH. As soon as I exit, that reverts to $USER. Since sudo remains active for a time specified in sudoers.conf, what happens to .profile and $PATH upon exiting? (Note: I actually don't know, being a rare sudo invoker)
Since sudo remains active for a time specified in sudoers.conf, what happens to .profile and $PATH upon exiting? (Note: I actually don't know, being a rare sudo invoker)
The "active" refers to how long the password is cached. This is usually more relevant for single shot invocations of the form of sudo <some command> (because you might want to do several in a row). When using sudo -i, the shell and its environment variables last as long as the shell runs of course.
While that is certainly a valid choice, I prefer to actually have a root account and disallow multiple root logins. This almost completely rules out functioning rootkits. One can do this and still only use sudo, but several distros by default do not even setup a root account. I consider this a minor mistake.
While that is certainly a valid choice, I prefer to actually have a root account and disallow multiple root logins. This almost completely rules out functioning rootkits. One can do this and still only use sudo, but several distros by default do not even setup a root account. I consider this a minor mistake.
This makes sense. But tell us, please, Enorbet. How does one do that? How do you disallow multiple root logins?
(Oh yeah - I'd consider that a "good to know." )
Making it impossible to log in directly as root enhances security. Let someone try to log in as root with a dictionary based password cracker, and they may eventually get in. Change ' may eventually' to " will never" if root logon is disabled.
There is NOTHING that su can do that sudo cannot, if 'sudo su' is enabled. One difference is that sudo leaves a clearer 'paper trail' in a separate log. Another is that it allows for much finer controls.
It is not a 'one or the other' choice: BOTH of them are used on all of my Linux systems at home and work. Each has a proper place and purpose on EVERY system.
Afterthought: perhaps not on a simple proof of concept virtual machine where security is irrelevant and it will be quickly blown away.
Making it impossible to log in directly as root enhances security. Let someone try to log in as root with a dictionary based password cracker, and they may eventually get in. Change ' may eventually' to " will never" if root logon is disabled.
Spoken like a true Windows warrior, what is the difference between using a static account (root) and a user that has sudo access? Nothing at all.. here is why:
So you have no root password on your system, cool, however what do you login with via SSH? You user? so when that gets cracked, what is the difference between root and sudo -i? or sudo su? the answer is nothing.
In fact, using a root account is more secure then using sudo and here is why:
1) sshd by default doesn't allow root to login, so if the admin was smart about this his account would be a totally normal account without sudo access and when its required just su to root.
2) Using this the attacker actually has to crack two accounts not just a user who is prevleged... its just a weak argument against having a root account..
3) This is Windows security through obscurity bs, sudo only exists because ubuntu wanted to Windowize Linux to being it closer to the masses (which it didnt do).
Quote:
There is NOTHING that su can do that sudo cannot, if 'sudo su' is enabled. One difference is that sudo leaves a clearer 'paper trail' in a separate log. Another is that it allows for much finer controls.
It is not a 'one or the other' choice: BOTH of them are used on all of my Linux systems at home and work. Each has a proper place and purpose on EVERY system.
Afterthought: perhaps not on a simple proof of concept virtual machine where security is irrelevant and it will be quickly blown away.
sudo was never designed to paper tail everyone, here is a simple fact, The real admins who can be trusted don't need to be logged, their is no reason why a user needs to play with any utilities that require root access. sudo is basically the UAC of Linux nothing more nothing less, most vetted admins that run more then Linux and BSD will laugh at you for thinking sudo has some super powers over su.
Last edited by /dev/random; 05-02-2016 at 01:24 PM.
This makes sense. But tell us, please, Enorbet. How does one do that? How do you disallow multiple root logins?
(Oh yeah - I'd consider that a "good to know." )
While this does vary by distro (some have "/etc/security/limits.conf" and some don't, some have PAM and SELinux and some don't) most have SSH and other means of limiting logins of any User, including "root". One good method is to create a toggle script to disallow ANY remote logins and only enable it when YOU need it. Here is but one list of several more general means of limitations
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.