Printable View
I have read several *nix books that strongly advise to "avoid logging in as root" and better use 'su' instead. These books mention it has to do with security issues but they do not give further explanations as to why and how it is exploited.
I will appreciate detailed exploits. Thanks.
well, for one thing, if you are remotely controlled when you are logged in as root, bad things can happen bcuz the hacker can change EVERYTHING (because you're logged in as root, so that account, the one the hacker is controlling, has total control over the entire system). Also, if you accidentally get a letter wrong in a command, since you're in root, you could wreck your system. It's not near as easy in a standard account. That's why people don't use root for everyday access.
btw: 'su' is probably 'standard user'
if u run as a normal user, uve less chance of mucking everything up, if u run a file in root it has access to everything.
preep
cyb3rn3tik - 'su' stands for Switch User.
pinoy - Logging in as root is not so much a matter of 'exploits' as it is good administration practice. First, there is the doing the wrong thing in the wrong place/directory. Like cyb said, you can cause yourself some serious damage. If you have to use the 'su' command to perform a function, hopefully your a little more focused on what your doing, thereby, avoiding mistakes. Secondly, ( and I am sure everyone here has done this), you log in as root, your working away and you get distracted by another problem that needs your attention. You take off to deal with the other issue, now you may be gone only minutes or hours, point is, you just walked away from a server and left it logged in as root. Now I come in behind you, and what have I got, in short, I now own your server.
Save yourself a few headaches, always 'su' to root.
Cheers:
hmmmmm i always thought that su ment super user, cause it defaults to root when you give it that command, but i can see why it switch user as well
oh yeah, and exactly why do you want "detailed exploits"?
DjM is very correct. You also have to remember if you have multiple system administrators, it is better to have them log in as their normal user ID and su to do system maintenance for logging purposes (or even better use something like sudo).
The primary philosophy is do the stuff you need to do as root and immediately log back out to a regular user, there is much less of a chance of a stupid mistake causing permanant damage...
Neb
You can 'su' to any account on a *uix system, providing you know the account password. If you are root, then you can 'su' to any account without a password. (at least it use to be like that, I haven't played with *uix for awhile now).
Cheers:
i used linux once or twice.. and this was quite nice to read.. =/
Also, if you run a trojan/virus, it will have 100% rwx on everything. That would suck
Put simply (as we always used to say) root leaves big footprints.Quote:
Originally posted here by pinoy
I have read several *nix books that strongly advise to "avoid logging in as root" and better use 'su' instead. These books mention it has to do with security issues but they do not give further explanations as to why and how it is exploited.
I will appreciate detailed exploits. Thanks.
Pretty much, there's nothing you won't be able to do as root, whether you intend to or not... that includes deleting needed files caught in a typo or filling your disk up so full that your system will not be able to reboot (you can fill the disk up as a normal user, too - but it's smart enough to leave a reserve).
There are lots of reasons to not do this... pretty much the easiest one - it pretty much defeats all security on the box.
Not allowin root login with remote services like ssh also adds to the sercurity because you have to know two passwords instead of one to get to a root shell.
Don't know if this is like this in other *nixs too, but in openbsd, if the weel group is populated, only members of wheel can su to root. So if you make sure all members of wheel have strong passwords and so does root, brute forcing youre way to root would be considerably longer...
Ammo
That's pretty much it. You can also use other utilites to control your work as root, like sudo. I like sudo, because you have much more control over commands executed by multiple admins, it will ask for a password for each command (helping you to make sure that you want to do something) and you NEVER have to give out the root password. Giving out the root password to multiple people is just bad policy all around.Quote:
Put simply (as we always used to say) root leaves big footprints.
Pretty much, there's nothing you won't be able to do as root, whether you intend to or not... that includes deleting needed files caught in a typo or filling your disk up so full that your system will not be able to reboot (you can fill the disk up as a normal user, too - but it's smart enough to leave a reserve).
There are lots of reasons to not do this... pretty much the easiest one - it pretty much defeats all security on the box.
yes i know...... and to simplify that, you can su to any account provided that you know the root password (or the password of someone in an equivelant group)Quote:
Originally posted here by DjM
You can 'su' to any account on a *uix system, providing you know the account password. If you are root, then you can 'su' to any account without a password. (at least it use to be like that, I haven't played with *uix for awhile now).
also, incase you think of it giving your 'personal' account access in the root group dosnt do anything differently than just logging in as root so you kinda get screwed the same way if your account has full privelages...... if that makes any sence to anyone but me
su = set user IDQuote:
On solaris su - will set user ID to root (you need the password)
su someOtherUser -will make u that user
Cheers,
Duncan
If the above was posted elsewhere I aploize for the duplicate
rm -rf *
from the / directory
pretty much says everything about why you shouldnt run as root all the time.
BTW, I been there and done that. thankfuly it was just my personal machine
Also, even if you are very very careful about what commands you use and apps you run, if you have to leave a machine for an emergency bathroom or cofee run and dont logout, someone else could cause many problems for you if you are logged in as root
I always thought su was super user as well as one other in this thread... hmm...