RootSudo
Differences between revisions 19 and 47 (spanning 28 versions)
|
Size: 7885
Comment: dapper --> 6.04
|
← Revision 47 as of 2008-08-06 16:29:06 ⇥
Size: 52
Comment: converted to 1.6 markup
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| ||<tablestyle="float:right; font-size: 0.9em; width:40%; background:#F1F1ED; margin: 0 0 1em 1em;" style="padding:0.5em;">'''Contents'''[[BR]][[TableOfContents]]|| By default, the password for root is locked in Ubuntu. This means you cannot login as root or use su. Instead, the installer will setup sudo to allow the user that is created during install to run all administrative commands. This means that in the terminal you can use sudo for commands that require root privileges. All programs in the menu will use a graphical sudo to prompt for a password. When sudo asks for a password, it needs '''YOUR password''', this means that a root password is not needed. == Notes == * The password is stored by default for 15 minutes. After that time, you will need to enter your password again. * To run the graphical configuration utilities with {{{sudo}}}, simply launch the application via the menu. * To run a program using {{{sudo}}} that normally is run as the user, such as '''gedit''', go to {{{Applications --> Run Application}}} and enter {{{gksudo gedit}}}. *For users of ''Kubuntu'', use {{{kdesu}}} in replacement for {{{gksudo}}}. * '''Ubuntu 5.10 (Breezy Badger) users''', go to {{{Applications --> System Tools --> Run as different user}}}. * To use {{{sudo}}} on the command line, preface the command with {{{sudo}}}, as below: ''Example #1'' {{{ sudo chown bob * }}} ''Example #2'' {{{ sudo /etc/init.d/networking restart }}} * '''NEVER''' use sudo to start graphical programs. You should always use gksudo or kdesu to run such programs, otherwise new login attempts may fail. * To start a ''root shell'' (i.e. a command window where you can run root commands) use: {{{ sudo -i }}} == Allowing other users to run sudo == === Ubuntu 4.10 (Warty Warthog) === In Warty, adding a new user involves editing the {{{/etc/sudoers}}} file. To edit that file, you must use {{{visudo}}} as it will error check the file before exiting. To add a user with the same administration rights as the first user, add the following lines to the file: {{{ $newuser ALL=(ALL) ALL }}} <!> ''Replace the $newuser with the username.''[[BR]] <!> When upgrading from Warty, to a newer version, add the admin group to /etc/sudoers using the line {{{ %admin ALL=(ALL) ALL }}} And add the initial user to the admin group {{{ sudo adduser $(geteent passwd 1000 | cut -f 1 -d :) admin }}} === Ubuntu 5.04 (Hoary Hedgehog) & Ubuntu 5.10 (Breezy Badger) === To add a new user to sudo, open the '''Users and Groups''' tool from {{{System --> Adminitration}}} menu. Then click on the user and then on properties. Choose the '''User Privileges''' tab. In the tab, find '''Executing system administration tasks''' and check that. /!\ In the terminal this would be: {{{sudo adduser $user admin}}}, where you replace $user with the name of the user. == Benefits of using sudo == The benefits of leaving '''root''' disabled by default include the following: * The installer has to ask less questions * Users don't have to remember an extra password, which they are likely to forget * It avoids the "I can do ''anything''" interactive login by default -you will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing. * Sudo adds a log entry of the command(s) run (In {{{/var/log/auth.log}}}). If you mess up, you can always go back and see what commands were run. It is also nice for auditing. * Every cracker trying to ''brute-force'' their way into your box will know it has an account named ''root'' and will try that first. What they don't know is what the usernames of your other users are. * Allows easy transfer for admin rights, in a short term or long term period, by adding and removing users from groups, while not compromising the ''root'' account. * sudo can be setup with a much more fine-grained security policy == Downsides of using sudo == Although for desktops the benefits of using sudo are great, there are possible issues which need to be noted: * Redirecting the output of commands run with sudo can catch new users out. For instance consider {{{sudo ls > /root/somefile}}} will not work since it is the shell that tries to write to that file. You can use `ls | sudo tee -a /root/somefile` to append, or `ls | sudo tee /root/somefile` to overwrite contents. * In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to leave the system unusable unless cracked. An extra local user, or an enabled root password is needed here. == Misconceptions == * ''Isn't sudo less secure than su?'' The basic security model is the same, and therefore these two systems share their primary weaknesses. Any user who uses `su` '''or''' `sudo` must be considered to be a privileged user. If that user's account is compromised by an attacker, the attacker can also gain root privileges the next time the user does so. The user account is the weak link in this chain, and so must be protected with the same care as root. On a more esoteric level, `sudo` provides some features which encourage different work habits, which can positively impact the security of the system. `sudo` is commonly used to execute only a single command, while `su` is generally used to open a shell and execute multiple commands. The `sudo` approach reduces the likelihood of a root shell being left open indefinitely, and encourages the user to minimize their use of root privileges. * ''I won't be able to enter single-user mode!'' The sulogin program in Ubuntu is patched to handle the default case of a locked root password. == Going back to a traditional root account == <!> This is not recommended! === Enabling the root account === To enable the root account (i.e. set a password) use: {{{ sudo passwd root }}} Enter your existing password[[BR]] Enter password for root[[BR]] Confirm password for root === Disabling the root account === If you have enabled a root password and wish to disable it again. To disable the root account after you have enabled it use: {{{ sudo passwd -l root }}} This locks the root account. [[BR]] [[BR]] <!> This will also prevent you starting the computer in recovery mode on versions of Ubuntu before Ubuntu 6.04 (Dapper Drake) * This is because the password value for root in /etc/shadow is not automatically returned to the single * character required for passwordless recovery log in as root. (You will be asked for a password, as one still exists, but will not be able to log in as it is locked.) You will need to edit /etc/shadow to prevent this problem after enabling and then locking the root account. This has been fixed for Ubuntu 6.04 (Dapper Drake) (Flight 3 onwards), locked password and null (*) password are now treated as the same when recovery mode is started. === Let sudo ask for the root password === You can make sudo ask for the root password instead of the user password, you can do this by adding the keyword {{{rootpw}}} to the line in {{{/etc/sudoers}}} that starts with {{{Defaults}}}. === Enabling graphical root login === <!> It is highly recommended not to allow root to login graphically! ==== In Gnome ==== * Open System --> Administration --> Login Screen Setup * Click on the security tab * Check {{{Allow root login}}} ==== In KDE ==== * Open Konqueror and open the /etc/kde3/kdm/ folder * Right click the kdmrc file and then Actions --> 'Edit as root' * On line 246 should be {{{AllowRootLogin=false}}} change it to 'true' * Save and exit. ---- CategoryDocumentation |
#REFRESH 0 http://help.ubuntu.com/community/RootSudo |
RootSudo (last edited 2008-08-06 16:29:06 by localhost)