Forgot your password?
typodupeerror

Got Root - Should You Use It? 245

Posted by Cliff
from the great-power-great-responsibility dept.
vegthura asks: "I have several coworkers that insist that logging into servers is an acceptable practice. They claim it's just easier than using sudo and it's just as safe - you know you're root so what else do you need? And why bother logging in as you if you're just going to use sudo to run commands with root privileges anyway? Everything I've ever read has been the exact opposite philosophy. There is very little you need to be root to do, if anything in practice, and using sudo lets you only use the power of root for when you really need it. So, die hard unix geeks, you've got root... do you use it or stick to sudo?"
This discussion has been archived. No new comments can be posted.

Got Root - Should You Use It?

Comments Filter:
  • It depends... (Score:5, Interesting)

    by D'Arque Bishop (84624) on Saturday April 15, 2006 @10:18PM (#15136200) Homepage
    For me, it all depends on whether or not the machine is one I directly own or control.

    If it is one I personally own or am more or less directly responsible for above anyone else, then I use root if needed.

    If it's one that I don't personally own or I'm reporting to someone else who's ultimately responsible for the machine, I don't ask for the root password and request sudo access instead. That way, there's a log of my actions so I can go back and show exactly what I was and wasn't responsible for doing. Showing accountability is key when you're in a position of trust, IMHO.

    Just my $.02...
  • Got Root - Need Root (Score:4, Interesting)

    by Ajehals (947354) <a.halsall@pirateparty.org.uk> on Saturday April 15, 2006 @10:45PM (#15136406) Homepage Journal
    (Disclaimer, its 3 am, I've just given up doing a code audit on the basis that I am too tired, so if this doesn't make sense, I am sorry, oh and don't take my advice or even think about relying it the following statement is as is, and comes with no warranty - would be first post but its taken me half an hour to write this.. :) )

    When you are logged in as root you have unlimited access to all files, and it is possible to remove or modify a file that is vital to the system, this is generally not good, and often not required. If you set up a server securely you should be able to create accounts that have the access that you require to carry out specific tasks (still preferably using sudo, or su'ing to the relevant account), this is as much a common sense measure as pure security precaution.

    You could argue that you can log in as root as long as you avoid using wild card designators when executing commands and keep track of your current working directory and try not to mess anything up, but there are a load good reasons to use sudo or su to root (or preferably an account specified for a task) instead, here are the ones I find most important:

    Firstly you get some accounting, if Joe Bloggs su's to root and breaks / steals / misconfigure's something, at least you know it was Joe Bloggs (or someone using Joes account)

    Secondly if you have remote access only as a non root user (this should be a given, never log in via ssh or webmin or whatever as root, (it can be a nightmare when you think your on system A but are on system B and do something you didn't mean to, never mind as root...) any attacker is going to have to find a non privileged account to gain access to a system, and then gain root privileges..

    Thirdly if you have set up a number of administrative users for specific tasks you can compartmentalise your systems maintenance and you don't have to give someone you don't trust root access to carry out basic maintenance.

    Lastly, the less you use your root account (directly or by whatever means) the less likely you are to break it. Lets be honest, I'd love to log in as root all the time, it would make life easier, but it would get rid of quite a few of the security benefits Linux/Unix brings and I'd probably break things more often. If you get used to using the root account you will continue to use it more and more until you find yourself logged in as root surfing the web whilst playing some bzflag beta just waiting for someone or something to break your box. (not to mention the hours you would spend making it possible to log in as root and use all your apps that are (probably) not going to like being run as root).

    Personally when I set up a secure server I try to ensure that I have users with the relevant rights set up for specific tasks and no more and only issue those accounts to users who require them. I mount as many of the file systems as possible read only, I try to ensure I ship log files out to a box that no-one with root privileges on the first box has access to, and I automate as many of the maintenance tasks as possible. Oh and I don't use sudo, and on hyper critical servers the full root password is known to no one, I have half my oppo has the other half, and never the two shall meet (although this causes inconvenience when you do need it...!!)

    This prevents foul ups and gives you a security baseline.

    Oh and if you do log in as root make sure its not ever into a Desktop Environment (or any complex environment really) because there are just too many apps executing as root at that point to keep track of properly, and way too many potential security vulnerabilities...

  • by Henry V .009 (518000) on Saturday April 15, 2006 @10:47PM (#15136415) Journal
    There are benefits to using sudo, and depending on the situation some of those may become very important. But one con I'd like to point out is the dependence on the sudoers file. You can mangle a system (requiring a reboot to single-user) with one wrong entry. And if you are constantly editing it to give users fine-grained privileges, that risk is important to weigh against the benefits.

    And if (as with my current job) you work someplace with:
    1. Low employee turnover.
    2. Lots of servers.
    3. Few people with root access.
    4. LDAP authentication for passwords to make changing the root password on all servers easy.
    Then maintaining seperate sudoers files on every server is far more pain than it's worth.
  • Re:I stick to sudo (Score:5, Interesting)

    by Tragek (772040) on Saturday April 15, 2006 @11:10PM (#15136500) Journal
    See; in theory, its a great idea. But by the same principle that some nerds start typing digg when they mean dig, and del.icio.us when they meant delicious, I manage for the most part to disable the mental brake that stops me from using sudo wishywashily. I type sudo rm -r * with the same ease that I type rm -r. My hands muscle memory once started is faster than my brain. I guess I just have to trust that my initial aim is true.
  • by shift (222320) on Saturday April 15, 2006 @11:29PM (#15136571)
    I hate coming into a place and finding out that passwords for accounts like root are shared. Its also a real pain when someone leaves the company. Where I work, we've basically tossed out the root password and grant access with sudo. We just have to disable accounts when someone leaves and not scramble to change a password then make sure every who needs to know is notified.
  • Sudo's intended use (Score:3, Interesting)

    by RomulusNR (29439) on Sunday April 16, 2006 @12:36AM (#15136810) Homepage
    Sudo's main benefit IMO is to keep unattended terminals and non-password-based attacks from being no-brainer vectors to root. It's not to make it a pain for you to have to type a password just to run root commands; its to make it so that the user is able to run certain root commands and making extra sure before doing so that it is really that user running them (not a hijacked terminal, etc.)

    The other benefit is that it allows you to pick and choose who needs access to what root privileges. Junior data center tech A doesn't need access to fsck(), but maybe needs to be able to mount /dev/sdc. (OK, poor example.)

    Sudo isn't IMO the solution for all admins, though; extensive admin work quite necessarily can be done with su to root instead. Sudo allows you to keep the root password on a tight leash -- preferably to those who can be responsible with their sessions as well as with root powers.
  • Re:Using Root. (Score:3, Interesting)

    by fimbulvetr (598306) on Sunday April 16, 2006 @03:53AM (#15137283)
    He who plays with root, will soon kill tree.

    Someone other than me deserves credit for this oh-so-true statement.
  • Re:Wrong (Score:3, Interesting)

    by nagora (177841) on Sunday April 16, 2006 @04:58AM (#15137407)
    and there are all kinds of server admin tasks you might need to do, that don't need to involve becoming root. Database administration, for example.

    All normal database admin can be done with various programs that access the server remotely (by which I don't mean ssh!). Abnormal admin that requires actually logging into the server pretty well always requires root. The same goes for everything else.

    It is true that the daemons should not RUN as root but by and large every one of them needs root to do anything drastic to their configuration or rescue data in the case of a crapped-out drive. For everything else there's SWAT, CUPS, phpadmin, even good old Webmin & co. All these use HTTP in one way or another and reduce the day-to-day need to login to zero.

    There's just no need to be on your server unless you are root.

    TWWW

  • by LABarr (14341) on Sunday April 16, 2006 @05:27AM (#15137449) Homepage
    I read all the previous posts to this discussion and recalled another glaring obvious reason why you should use sudo vs. root logins. No one has brought this up yet, but when you step away from your desk for that quick trip to the john, and then get snagged for that impromtu 20 minute meeting in the hall, away from your desk the whole time, and you leave a root terminal open on your computer, you really are just asking for trouble. Remember that the largest percentage of security breaches occur from within, not outside the company. At least when you use sudo (as is almost always considered best-practice) from your normal user account, you aren't leaving the door totally wide open when you are away from your desk. Sure, I know all about locking your your display, (which I personally do) even automatically via a screensaver, but the again I have also seen a lot of scary simple root passwords as well. Sloppy habits make sloppy admin'ing. I admin my personal servers as well as any for anyone else via sudo. Another vote soundly in the sudo column.

    Sudo and the less voodoo you do to whom?

    ___
    Simulated sig.
  • Re:Audit trail (Score:4, Interesting)

    by TilJ (7607) on Sunday April 16, 2006 @11:20AM (#15138080) Homepage
    If you're serious about the auditing functionality, you need more than just sudo.

    Doug Hanks, a SAGE member, started with sudosh (http://sourceforge.net/projects/sudosh/ [sourceforge.net]) and now has released Enterprise Audit Shell (EAS). There's a very basic web page and PDF at http://download.strchr.net/ [strchr.net], as well as a nice graphic explaining how it works (http://download.strchr.net/eas-layout.png [strchr.net]).

    Copying from the text of the email announcement a few weeks ago, the list of improvements over Sudosh includes:

    * Conforms to COBiT
    * Utilized ITIL best practices
    * Enterprise-view of UNIX access
    * Enterprise-level audit reporting tools for Sarbanes-Oxley
    * Customizable audit reports via CSS
    * Embedded transactional, ACID-compliant SQL92 relational database
    * Load balancing
    * Disaster recovery
    * SSL encryption
    * SSL Public Key Infrastructure authentication
    * Audit file transfers and remote command execution when used as a login shell
    * Configurable default shels
    * Audit logs are digitally signed for integrity
    * Client and server configuration files for easy management
    * Idle session timeout
    * Display corporate policy before eash session

    It looks like a serious auditing tool for serious Unix shops.

    For simpler needs there's also Kerberos `ksu` as a replacement for sudo, for shops that have already solved their centralized authentication.

"Ask not what A Group of Employees can do for you. But ask what can All Employees do for A Group of Employees." -- Mike Dennison

Working...