Root Password Confusion
 

Hi, I tried to change my root password with "passwd root" or something like that I can't quite remember. It kinda worked, but now I have two passwords for root, the original password is correct nine times out of ten, on rare occasions it will require the new password.

I just want one root password, the new one I added. Can someone help? I'm on Arch (Arco).

Thanks
G-Wiz

Hi, and welcome here, at LQ

The root can have (and must have) only one password. It is impossible to use two different ones. So would be nice to explain (with more details) what's happening. How did you try, what did you try, what's happened...?

Root has just one password - sudo may have many, (as any user in the group 'wheel' will use their own password).

Half the keyboard on an Acer tablet were incorrectly mapped when I would run Ubuntu live on it. Had to use Ubuntu's onscreen keyboard.

If you feel you have to use two different passwords is most likely due to faulty keyboard mapping or something, you are probably using only one password as it is unheard of to have two root passwords.

Perhaps look into trying a corded keyboard/mouse, and make sure no power bars or excess power cords are on the desktop. I recently upgraded my wireless keyboard/mouse combo and was loosing my work, text editor would go wonky while tweaking scripts and I would essentially loose everything since the last backup. The mouse pad I was using was fabric based and there was a power bar on the table, some form of static was screwing everything up in a Virtual Machine, not sure if it was affecting the host. I went and bought a new (nice) corded keyboard and had corded mouse, switch to that, move power stuff off and all is good.

EDIT: This is a laptop with attached HDMI monitor, hence the need for separate keyboard/mouse

Thanks for the information, it would seem I just didn't understand what was happening. I now realise I was confusing my passwords which at first were the same, but after changing the root password, I thought sudo was asking for the root password, not mine, then when actually asked for the root password I had to use the "new" one.

My own stupidity :doh:

However, now that you realize that “root access” can effortlessly be gained by anyone in the wheel-group, you can now very plainly see the importance of limiting that privilege to as few users as possible: ideally, “only one.”

The userids that you use every day should not belong to that group. So, if any “rogue software” runs into a telephone booth, the only thing they can do is to … make a phone call.

P.S. This so-called “principle of least privilege” applies to every operating system. Computers are terrible at saying “yes,” but extremely good at saying “no.”

If I remove myself from the wheel group, when I run sudo would it then require the root password instead of mine?

No. It would just print a nasty message
and refuse to give you superuser rights.

su - would require the root password.

OK, just to make sure I have this, your saying it's much more secure to remove myself from the wheel group, this will no longer allow me to use sudo with my password, but I can use su instead with the root password?

I didn't say this, sundialsvcs did. Complaining about inadequate default security is his favorite subject.

It all depends on what is in your /etc/sudoers file. Some distros give full sudo access to users in the wheel group or in some special "sudo" group (I believe Debian-based distros have a sudo group for this purpose) and automatically place the first registered user in that group. Others place the first registered user in sudoers by name and not as a member of a group.

The wheel group originally determined who could use the su command to become root. Knowing the root password wasn't enough; you also had to be in this group for the password to work. Sudo came much later.

Incidently many implementations of sudo come with much worse messages than the one quoted by shruggy.

An OpenBSD guy recently adapted this feature for doas as well.

By removing yourself from this group, you voluntarily revoke your right to say: sudo su. That is, “to gain root access using your own password.” To exercise these privileges going forward, you must consciously log in as “Clark Kent.” The login(s) that you use every day are not privileged at all. And, while using them, you know to never respond to any request for an elevated password … unless you are damned sure.

By doing these things, you ensure that the system will “always say ‘no,’” particularly when you were not aware that any [rogue …] was asking.

Principle Of Least Privilege

That would be sudo and su, not the "usual" sudo su combination.
https://acloudguru.com/hands-on-labs...th-wheel-group