switching user mode

I am new to the Linux scene but I have been working with Mandrake and Redhat for about 10 hours a day for the last 3 days and I am getting the hang out it. However with my Mandrake 8.2 (I am upgrading to 10 as we speak) when I have a terminal open and then I try to switch to login as root is says "incorrect login." However if I open the terminal as a "superuser" it allows me to do so with the password.

I have googled this and couldn't find anything. I have a theory but I am not sure so here it is. Could I not be allowed to switch from a user to a "superuser" without being in a SSH not sure but that is my idea.

I just sorta wanna figure out the problem and if it is infact a problem.


Thanks,

Adiz

Im not quite sure if this is what you mean, but to get root privaleges from being a user, open a konsole window then use the su command i.e, "su root", then just type the relevant password, you should now be root!

As i said im not sure if this is what you ment!

You shouldn't even have to go "su root", but rather just "su",although you should always include the entire path for the su command, for security purposes, ie, "/usr/bin/su". This done in case someone writes a simple fake su program and dumps it in your home directory, although I doubt that is the case here.

Happy su-ing.

No, I know how to get to login to root but if I open up a konsole as my normal user and type:

Login root

I am prompted for the password. I will then type the password and will receive and incorrect login error.

So I am just curious it isn't harming my linux experience in anyway.


Adiz

I belive that is a security feature?


Only the super-user konsole can go su root?

I don't think that's a security feature so much as it's a Mandrake fluke. While I can't really think of any reason you would go "login root" rather than "su", they both should work. Five bucks says that when you upgrade to Mandrake 10, you won't have that problem. Anything 8.2 or below was kinda flakey, in my opinion. Apparently the makers of Mandrake agreed, as you can't upgrade from anything 8.2 or below ( I think you have to do a fresh install...).

Quote:

---

Login root

---

No no no, you simply can't do that. When opening up any terminal in your normal user, that term is being ran by your current user. IF you want to change (temporarily) the user within the terminal you open use the command su. login root won't work because you are already logged in on that terminal.

Meh - login root works on my machine, buddy.

Parz:~ embro$ login root
Password:
Last login: Sun Feb 8 17:44:40 on ttyp2
Parz:~ root#

pooh - It has to work because I can go backwards. If I log into root and go backwards to my user it allows me to do that.

Ok, so it seems we are going to attribute it to a fluke. Cause it doesn't seem like a security feature.


Thanks,

- adiz

Quote:

---

Originally posted here by adiz
pooh - It has to work because I can go backwards. If I log into root and go backwards to my user it allows me to do that.


- adiz

---

Meh, as superuser, you own everyone, so permissions would allow you to go backwards, but not necessarily the other way around, so pooh has a point there. Maybe its a system-dependent thing.

I'll check that out on my SuSE box later....


I've never encountered this before... If I need root privledges, I logon as root to begin with....

Quote:

---

the command su. login root won't work because you are already logged in on that terminal.

---

Quote:

---

Meh, as superuser, you own everyone, so permissions would allow you to go backwards, but not necessarily the other way around, so pooh has a point there

---

I would assume that as superuser you could login as anyone. However I was just wondering why even if I have the login and password for root I still can't login (it didn't make sense) but anyway. So all I was saying that it should work (if you have password) however it will not let me.

I am not sure if it is a security feature or a bug but either way I was wondering.

- Adiz

Quote:

---

I logon as root to begin with

---

Shame shame. Always su root or sudo!

I mean it isn't a problem i can just open up a new konsole but it was a question. Like I said I am new to Linux and was wondering if A: I had done something wrong or B: I am just retarded (haha). However it isn't a problem just wondering if anyone else experienced this.


- Adiz

Quote:

---

So all I was saying that it should work

---

No, it shouldn't work :) How can I explain this:

1. You login as your normal user
2. You start x windows as your normal user
3. You start an xterm to use the Login command and try to login
4. Login smacks you because you are logged in as a user already, in x already, and the term already.
5. su is the command to temporarily changed who you are within that x-terminal. Correct password or not, Login won't allow you to login over yourself. Security hazard and waste since su root fullfills that function.


edit This is what I get on my slack machine:

Quote:

---

poohsuntzu@kitten:~$ login
No utmp entry. You must exec "login" from the lowest level "sh"

---

This is because login is a literal login, not a temporary user change.

Quote:

---

Meh - login root works on my machine, buddy

---

That's an absolutley terrifying security risk, much less than it actually being allowed.

I agree with you pooh I am looking at this and it seems as though it would be a security risk. However my curiousity was raised when I was given the possibilities of entering a password. It should just say something like "incorrect command (or

Quote:

---

No utmp entry. You must exec "login" from the lowest level "sh"

---

).

I kinda want to see what will turn this on and off would this not be a security risk if this was allowed to work!?! Then it makes me wonder if that login would be logged? Well I new to linux so I am just trying to learn commands.

Oh well. I will just load my new version of mandrake and see what happens!


- Adiz

Quote:

---

That's an absolutley terrifying security risk, much less than it actually being allowed.

---

I don't think so, in my case. My best guess is that when you come across a machine that lets you do the "login" command from an xterm or konsole, the "login" in question is not the real one, but rather an addition added in by the programmers. It's probably just doing the same thing as "sudo", much like Mandrake previously supported a "shutdown -h now", which is now "halt -p now" (or something to that effect). If the login script was left was left unmodified, you would get that "No utmp entry. You must exec "login" from the lowest level "sh"", meaning you would have to do an Alt-(F1-F6) to go to an empty v-term, and then login.

It may make more sence if you compare it to windows.

OK, you are logged in as george bush and have administrator privaliges, but then tony blair comes along and wants to use the computer george is on, however tony only has a limited account.

So if tony logged on at the same time he would have access to all the administrator services as they would have to be running because there is an administrator logged on. which is obviously a security flaw.

George would have to "Switch User" which would log him off along with any admin privaliges that would have been running, so tony could then log on and only have access to the services he is entitled to.

Look on the "SU" command in the same way, if george typed "su tony" on his konsole it would effectivly log him off and log tony on, and vise versa of course.

But if he could just type login tony, how would the computer know george has logged of and to stop root privaliges?

I hope it explains it a little better?

Aight I see pooh you are right. I just read the definition of the su you command and its purpose:

Here it is:

su = Substitute User

The su command runs a shell with a substitute user and substitute group IDs. Basically , it allows you to log in to the system as a new user on a temporary basis, with a real and effective user Id, group ID, and supplemental groups. The shell is taken from password entry, or /bin/sh if none is specified there. If the user has a password su prompts for it unless the user has a real user ID (the superuser) .

-adiz

Quote:

---

It may make more sence if you compare it to windows.

---

Aw man...That can lead to serious head trauma. I don't think we're talking about the same thing here, but with respect to what you described, I think of it more like a tree. At the top is root. Each of the other branches are users. As root, I can jump down to any one of their branches. As a user, I would need a ladder or rope (or su command) to get up to root, and some damn good jumping legs (or su again) to get to other braches.

What you were describing would be more like this:
George Bush logs on. Tony Blair comes by, comments on how nice George's tie is, and asks if he could use the computer. George types "sudo my_bitch" and logs Tony on (no pass required, since Georgie is root, although he shouldn't be doing everyday crap as root. Maybe he's launching nukes or something). While George goes off to take a leak, Tony simply types "exit" and that drops him back into "GOD" (Georges account). From there, Tony can make large donations in the president's name to the United Negro College Fund. And blow up some stuff.

Not quite the same as Windows, since Macro$haft doesn't really implement user security in the same manner.

(Contrary to the voice of my post, I'm actually pro-Bush, though I wouldn't show it.)

Embro - Nice example it is very clear to me now :D :D

- Adiz

Quote:

---

since Macro$haft

---

Careful... show a bit of respect to the company that made personal computing as large as it is today.

In fact, you can do it under Windows. However, due to graphic interface constraints (that occurs on *nix too) you cant do it in the exact way at desktop. But you can run programs as other uids (runas) or can even break or change (wtih appropriate authority) security structure with impersonalization. There is an API group to do that.
Unix users are so adicted to su and sudo that think that all O.S. should use the same concept with the same implementation (please dont take this as offense)
For instance, on AS/400 you can see that implementation as "adopt authority".

Quote:

---

But you can run programs as other uids (runas) or can even break or change (wtih appropriate authority) security structure with impersonalization. There is an API group to do that.

---

100% correct.

But keep in mind that windows XP and 2k have the ability to allow multiple logins through X at once. It's a "Switch User" for the entire enviroment while keeping both users running at the same time.

Quote:

---

Careful... show a bit of respect to the company that made personal computing as large as it is today.

---

Pooh, I thought you were pissed off with MS? Or is that limited to being pissed off with their marketing/law department? (Not an accusation, just wondering)

Cheers,
cgkanchi

Quote:

---

Pooh, I thought you were pissed off with MS? Or is that limited to being pissed off with their marketing/law department? (Not an accusation, just wondering)

---

It's hard to explain, but I will try. I admire for Microsoft the coders and company (bill included) because let's admit it, they have a GUI interface and coding ability (anyything ever coded in mankind is buggy, don't hold it agaist them) that every other OS is striving for. I'm a huge fan of Microsoft's management and marketing Pre-Bill stepping down from management. This entire team, for this generation of MS, launched personal computing onto a new level while still being in the buisness to make money.

However, I hate Microsoft's current management (remember, Bill stepped down) for their descisions. Since Bill stepped down Microsoft has made a lot of bad choices I feel, from slapping Linux users in the face with the SCO payments, to marketing ME (that was NOT Bill's descision! He was pissed when he found out they released it). Thus I have a strong dislike for their marketing and management department (CEO included) for the post-Bill timeframe.

I don't mind MS i learned on them still use it all the time. Infact I am using windows 2000 boot right now.

- Adiz

I find most people that gripe against microsoft are either

1. Jealous of the ammount of money Billy made/makes
2. Skiddies/newbies who want to try and sound good by slagging Microsoft
3. Avid *nix users who really do dislike windows.

#2 is the most common IMHO

Although i do agree with Pooh's comments whole heartedly!

My main grip with MS is that you cant seem to go to a store now-a-days and buy a computer without some version of Windows on it.
Even if you dont agree with the license after you bought it and dont want to install/use windows, although they say you can take it back [windows], you have a pethetically small chance of actually getting a refund!!

But hey, thats life!

I like the new mandrake 10 it is far superior. However thanks to pooh I have figured out logging back and forth with the 'su' command. I am liking linux.

- Adiz

Running RH 9 with X running, I cannot login to root, but I can su to root. If I change to crtl -alt-F2 I can login to root. I find it easier just to su - than it is to change to another tty, although that has come in handy when my desktop froze on me. I can crt-alt-F1, kill the hung process and crt-alt-F7 back to my gui.

$ root
bash: root: command not found

$ login root
Password:
Login incorrect

If you do ctrl-alt-F1 - F6 and try it "login root" does not work but "root" does

localhost login: root
Password:
Last login: Tues Jun 8 22:10:56 on tty2

login: login root
Password:
Login incorrect

If you want to get back to the gui then use ctrl -alt -F7. So we are back to what pooh said and how a user can login multiple times.

However, when you are creating users you can simply turn-off their SU priviledges (at least in Mandrake 10 expert mode) so it is no a security worry you can simply turn off the su privledges and not worry about an "su" command from a user to the root.

- Adiz

P.S. - I am sure everyone knows ^ but I thought I would say it.

Quote:

---

let's admit it, they have a GUI interface and coding ability that every other OS is striving for

---

I dunno about that one... I mean everyone seems to be looking for the same "look and feel" as Windows environments, if only for the reason that it makes native Windows-users more liable to make the transition. As far as the actual code...I would venture to say a vast majority is bloat.

I do have to hand it to the programmers...if you look throught the source code, they comment their code VERY well. They have anywhere from 2 paragraphs to a page for a FUNCTION. Just one. I can barely stand to annotate what my programs DO, let alone describe each funtion or variable...