I use "su -" unless there's a compelling reason not to use root's environment.

i allways use "su -" if i need to be root.

My $.02.

There are purist that insist that we su to execute a single command and then exit back to your regular user. In a production environment I follow that closely. If I have to leave the console, I will drop out of the root user before I walk away.

When I'm working at home I will log in as my user, start x, open a console and "su -".

As the purist point out, one can do a lot of damage to ones system from the root shell. There is noting quite heart sinking when one gets the error "command not found" while cleaning up a directory; and discovering the last "remove all, no checking" was run from the root directory.

-JJ

My purist view:

My regular user account is not even able to become root (using su or sudo). I have a special account which I normally do not use and which is the only one on my system that can become root. When I need root, I first "su -" to this other account and then "sudo -i" to root...

Needless to say that root logins using ssh are disabled too.

Eric

1 members found this post helpful.

Eric, can I ask why you do it that way? Is it a security thing?

anybody remember DOS ?
kind of multi tasking
SINGLE USER ONLY and that single user was root
you had to stay aware of what you were doing ALL THE TIME
the last O/S you would want to use if you were half asleep at the keyboard

at one point every home computer user was running as root

what's such a big deal about avoiding running as root when you really need the power of root
why not log in as root you can log out of root's account with a simple exit command

Although I'm not Eric, nor do I play Alien Bob on TV...

Yes it's security. If one allows root logins, the computer is only one step from being hacked. Most SysAdmin (including me) will allow specific users to su to the root account. It requires two steps to authenticate to get root access.

Most user accounts are used throughout a network. Someone running a network sniffing program can get a users password, somewhat easily. By using a separate user to gain su access, it adds an additional layer of security.

An additional layer would be to require SSL keys.

...I now return you to your regular postings.

-JJ

That's interesting, how would I set this up myself?

I usually set up a short alias to 'sudo bash --login' and use that to get a new prompt (instead of 'su') whenever 'sudo' is not enough.

'su' asks for the password and I'm too lazy most of the time, that's why I very rarely use it. However, when i do, it's 'su -'.. I don't know why, but I just prefer having a clear environment.

Set up a new user and make him part of the group 'root', then edit /etc/login.defs. Search and edit the following line:
Make sure that your regular user is not in the group 'root'.
Edit /etc/sudoers so that either only that special user or (recommended) the group 'root' can sudo.

Here are a couple of ways to achieve this:

1. Edit /etc/login.defs and change the value of SU_WHEEL_ONLY to yes (Slackware's default is no)
   
   
   Code:

   SU_WHEEL_ONLY   yes

   Then add users you want to allow to su root to group wheel. Say we want to permit bob to su root:
   
   
   Code:

   # usermod -a -G wheel bob

2. Use su ACLs. For this we create /etc/suauth (not present in a default Slackware installation) and add our rules.
   
   
   • To deny su root to all users except bob:
     
     Code:

     root:ALL EXCEPT bob:DENY

   • To deny su root to all users except those in group wheel:
     
     Code:

     root:ALL EXCEPT GROUP wheel:DENY

   • To deny su to anyone to all users except bob:
     
     Code:

     ALL:ALL EXCEPT bob:DENY

   • To deny su root to all users except bob and allow bob but have him use his own password:
     
     Code:

     root:ALL EXCEPT bob:DENY
     root:bob:OWNPASS

   Use your creativity together with man suath to come up with other combinations. Note: the rule that's applied is the first that matches - so be careful with your ordering.

--mancha

3 members found this post helpful.

Thanks mancha, that's really helpful, much appreciated.