Things that can't be done without root password

smrutimandal · 04-03-2012, 08:00 AM

Hi,

My case is about Solaris 10, but this should be the same for all *nix based OS.

I received a proposition to revoke root password from support teams. Can somebody let me know a list of tasks for which, logging-in using the root password is absolutely necessary.

A few examples I can think of

1. Logging into systems from Consoles when /var is at 100%.

2. Taking the system into Single user mode.

I know most of the tasks can be performed by Sudo. I want to know the tasks which can't be performed using sudo.

Thanks in advance.

sundialsvcs · 04-03-2012, 08:31 AM

Actually... every one of those rules are determined by the PAM (Programmable Authentication Modules) facility within Linux.

See: man pam

smrutimandal · 04-03-2012, 10:03 AM

Quote:

Originally Posted by sundialsvcs

Actually... every one of those rules are determined by the PAM (Programmable Authentication Modules) facility within Linux.

See: man pam

Hi sundialsvcs,

Thanks for the suggestion and I am not talking about going around this restriction. I just want to know, in a off the shelf configuration Solaris 10, what are tasks which can't be performed if you can get root privilege using sudo and your password BUT do not know the root password.

I know two, logging into the system from serial console when /var is at 100% and going to Single user mode.

Do you know any other tasks when the user will absolutely need the root password.

Thanks.

pan64 · 04-05-2012, 08:54 AM

Mainly anything can be done with sudo. But in case of any ploblem you would try to troubleshoot with direct root access. I have already seen some programs which tried to identify the user as the owner of the terminal (and in case of sudo it is not the root).

smrutimandal · 04-06-2012, 02:30 AM

Quote:

Originally Posted by pan64

Mainly anything can be done with sudo. But in case of any ploblem you would try to troubleshoot with direct root access. I have already seen some programs which tried to identify the user as the owner of the terminal (and in case of sudo it is not the root).

Thanks pan64, I see where you are coming from. Can you give me one example of such an application/program.

pan64 · 04-06-2012, 03:38 AM

Unfortunately I can't recall it, but I have an example, what I'm talking about.
This is a part of a perl script:

Code:

    $iam = (getlogin || getpwuid($<))[0] || &Splat("Error: Unable to determine who you are.\n");
    chomp($iam);
....
    chomp($ami = `/usr/ucb/whoami`);

    if ($iam ne $ami) {
         &Splat("Error: You are logged in as $ami not $iam\n");
    }

(Splat drops an error message and quits). See http://perldoc.perl.org/functions/getpwuid.html and http://perldoc.perl.org/functions/getlogin.html for explanation.

So based on how did you logged on (telnet, ssh, su, sudo, ....), this code may fail. perl uses the standard C functions, and as it is described here: http://fclose.com/p/linux/man/3p-getlogin/ getlogin function shall return ... the user name associated by the login activity with the controlling terminal of the current process - and not the current user.

Some tools check if they were started as root and sometimes they fail because of this behavior.

sundialsvcs · 04-09-2012, 09:26 AM

If you are (foolishly...) in the group that can issue sudo, and if (insanely...) the su command is one that is allowed, then of course you "are root" even if you do not know the login password to the so-named user. Only a security prompt that required you to enter the value of that password would be an obstacle ... and of course, you could merely use your rootly powers to fiddle with the password files.

It is possible, however, to set up a system to use (say...) LDAP authentication for various things, such that the login event and not any subsequent sudo tomfoolery is "the guiding determination," and an external (LDAP) server is the one that ultimately must be persuaded with regard to your prerogatives.

But it does bear repeating: sudo, if you permit it at all, must not permit the su command to be issued using it!

jlliagre · 04-12-2012, 06:02 PM

Quote:

Originally Posted by smrutimandal

My case is about Solaris 10, but this should be the same for all *nix based OS.

It is actually not the same.
Solaris 10 implements RBAC which allows configuring root as a role and no more as a user. That means direct logins as root are not allowed anymore.

Quote:

I received a proposition to revoke root password from support teams. Can somebody let me know a list of tasks for which, logging-in using the root password is absolutely necessary.

There should be no such tasks on Solaris 10 (outside login in single user mode). This limitation was fixed with Solaris 11.