Looking in my file manager, I just noticed that I have two directories in my /home. I have /home/al and /home/guest.
The contents of both are identical!

Can I safely delete the /home/guest folder to conserve disk space? How did it get there in the first place? Does this mean that /home/al is actually the /home/root folder?

I am the sole user of this machine.

Thanks for the guidance.

alBERT in Orlando

Can you post the ouput of

If you installed Mandriva using the Mandriva One Live CD, you got the guest account from that installers configuration. To install Mandriva from the Mandriva One Live CD, you first boot the CD to a running Mandriva session. You are automatically logged in to the guest account when you boot from the Live CD. When you run the installer, a duplicate (non-compressed) copy of the Live CD is installed on your computer's hard drive (including the guest account). It is after the first reboot (from your hard drive) that you set up any regular user accounts (in your case the al account). Since all user accounts are created from the same 'blueprint', they should all appear to be the same initially. My experience with the Mandriva One Live CD is limited because i use it for troubleshooting purposes, and I prefer to install Mandriva using the ftp installation method (I'll have to write an article for my L.Q. Blog explaining the process).

Rather than deleting the /home/guest directory, you should run userdrake and remove the guest account. Start MCC (Tools > System Tools > Configure Your Computer in the menu system). Select System in the navigation panel (left). Open the Manage Users on System icon under Administration Tools in the main panel (right). Select (highlight) the guest user, then ALT+CLick the guest user and select Delete in the resulting pop-up menu. In the resulting pop-up dialog, check mark both Delete Home Directory: and Delete Mailbox: then click the Delete button. Close Userdrake and MCC. The guest account and its directory should have been removed.

If you did not install Mandriva using the Mandriva One Live CD, then I do not understand how you got the guest account.

(Now I step up on my soap box) The single characteristic I have come to dislike about the Mandriva One installation path is the fact that a regular user from a Mandriva One installation has far greater power than a regular user from any other Mandriva installation path (3 CD set, DVD, or my personal favorite - ftp). From an MDV One installation, I can open a terminal window and su to root with no root password. When I run the Software Installer or MCC I am not required to provide a root password. When I run any KDE utility (in kcontrol) I am not required to provide a root password when I press the Administrative Mode button. This at least, was my experience using MDV One (Spring) 2008.1 RC2 before the final was released. While I understand the need for a fairly relaxed security configuration when running as a Live CD (booting from the CD), I do not believe such a configuration is safe when run from a hard drive. In my opinion, there should be no difference in initial configuration following installation, no matter which method is used to complete that installation (other than which or how many software packages were installed). (Sorry for the soap box tirade, I'll get down now). NOTE: I have no experience using MDV Flash, so I have not included it here.

HTH,

total 20
drwx--x--x 37 al al 4096 2008-04-26 09:56 al/
lrwxrwxrwx 1 root root 8 2008-04-20 18:55 guest -> /home/al/
drwx------ 2 root root 16384 2008-04-20 18:43 lost+found/


This is interesting. Apparently root directs guest to al??? Is that what I'm seeing here?

I will go into MCC and remove the guest account.

Yes, I did install from the Mandrive One LiveCD...and it was a GREAT experience. Everything works as it should, all hardware was recognized the networking was flawless, the urpmi updates and mirrors performed as they should. All in all...I am a satisfied customer.

Am I running my system al with root privileges? This is dangerous, no?


alBERT

Starting MCC system - manage users shows only the "al" account in the list.

This is confusing?

alBERT

If there is no guest user or group reported in userdrake (make sure you clear the check mark for Filter System Users in the Options menu so you see all user accounts), you can safely delete the guest directory (weather it is a link to /home/al or not).

As for the administrative capabilities, check to see if you have a /etc/sudoers file (I am uncertain of the file name since I do not use sudo here). Also check that your al user is not listed as a member of the root group in userdrake. As I stated in my earlier post, I have limited experience using Mandriva One 2008.1 (Spring) other than a few weeks using the second release candidate, so I am unclear as to how Mandriva has chosen to configure it.

When it comes to system security, I tend to err on the side of caution. I assume that if bad things can happen, they will (my somewhat pessimistic version of Murphy's law) so I may be overreacting to my admittedly limited experience using MDV One, but it simply makes me uncomfortable being able to execute administrative tasks without being required to enter a root password. On the other hand (IIRC) I believe I was required to enter a root password to log in as root (or su to root) in a console screen. Overall, I found the security configuration from MDV One a bit confusing (inconsistent?) since I was able to open a terminal window (konsole - the KDE terminal window) and enter su to become root with no need for the root password. In fact, I was able to do any administrative task in KDE (the GUI) without providing my root password. It was only in a console screen that Mandriva behaved as I expected so perhaps the issue is with the kdesu configuration. My primary concern is that an attacker may be able to gain access to my system as my regular user. If my regular user is not required to enter the root password to perform administrative tasks (even if only from the GUI), then an attacker would have the same elevated privileges. How hard would it be then for the attacker to take over my system? Even though I had the system set up to disallow remote logins, such a measure may not be practical for all users and may not be any real protection either.

I believe the installer used in the MDV One Live CD is different from that used with the other installation paths (DVD, CD's of FTP), but (IMHO) that should not have any bearing on the system security configuration. If any one from the Mandriva Development Team reads this, I invite comment (or clarification). If my impressions are incorrect (and I hope they are) I would like to know that, and if they are not, I would like to know the rational behind the MDV One security configuration after installation to a hard drive.

Here, Here, I second those points by Ernie.

It seems as though the Live One dvd is a lot like Knoppix, makes a good rescue cd.