Comments on: The Free World: Day to Day Operations as Root. http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/ Linux Tips - Information for Using Linux Thu, 26 Nov 2009 21:39:06 -0500 http://wordpress.org/?v=2.8.4 hourly 1 By: JF http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-395 JF Thu, 16 Feb 2006 23:17:41 +0000 http://www.newlinuxuser.com/?p=122#comment-395 In fact, I don't really see the real advantage and what is so easy when you run as root. It's not to beginners to "dictate" how computering and why early computering scientist have designed the system this way.ue and can go to any workstation without a difference. I mean that those users who ask for root permission (I don't really know why) should have worked a little bit in a administrated company. And they should have estimate how many times administrators lost there time for these people who install forbidden software. Running as root would be really dangerous in the case of the program is not well written. Running as root and even looking a jpeg would be more dangerous. There was a security breach in jpeg some times ago... Running as root and even a crafted URL or website could be dangerous... If you don't run as root, you'll be happy if your kid goes on this URL and YOU don't loose your data. Also with all this system you're absolutly sure that an update will work (on good distro) and that your system will be patched exactly the way it should. Think about problem of SP2... Why? Because you didn't have any way to mess up this OS! Running as root would be dangerous in most enterprise config when using NFS for example. On a real network, each user is unique. For teh example about the clock time setting. Changing the clock will change the clock for any user that are working on the system, so this clock is not only for you, but also for any users logged on the system. And on Linux, there're plenty of virtual users which launch process in the backgroud. All those processes could be disturb while changing the date. Also, setting the good time on a computer is not a day to day action. And this example is not a good example at all, because the date is set by the network on current distribution. There's only Windows which doesn't set it directly out of the box. Why? Because the time is not set to GMT... It's exactly a demo why the begginer should not interfere with the choices made by computering engeneers... When you receive mail outdated on your box, they doesn't sort correctly. So, the computers HAVE to be on time, and it's not to the user to change the time. Also, for the program which are really usefull for day to day use, there's the SUID bit. Also, on Ubuntu/OSXTiger, this root user doesn't even exist and the user is asked his own password... So he doesn't even now that there's a root user! It's just a question of PAM configuration. So, please see pam and sudo and you'll see how running as a privileged user is really cool! When you're asked for your password : you can ask yourself : "Am I dooing something wrong?" "Did I made an error"... Have a look at Ubuntu (I'm sure there are other distrib that come with sudo confiigured but this one is very integrated) and see how security can meet ease of use... Linux is different in design from Windows : You rarely have to download a program yourself, there're package management such as urpmi or dpkg to do that. If the user have to install a program himself or compile it, he'll know what he is doing... And he'll know why using a Linux day after day program as root is not allowed. Running as root is like use your new home DVD player without the plastic protection... To sum up! Linux is about security and stability. That's the big difference with windows : It's thought by all. If Lindows no, Linspire, is made with this kind of breach in security, I prefer Windows... Because at least after the fighting against spywares... I can play a lot of games in Windows! lol! In fact, I don’t really see the real advantage and what is so easy when you run as root.

It’s not to beginners to “dictate” how computering and why early computering scientist have designed the system this way.ue and can go to any workstation without a difference. I mean that those users who ask for root permission (I don’t really know why) should have worked a little bit in a administrated company. And they should have estimate how many times administrators lost there time for these people who install forbidden software.

Running as root would be really dangerous in the case of the program is not well written. Running as root and even looking a jpeg would be more dangerous. There was a security breach in jpeg some times ago… Running as root and even a crafted URL or website could be dangerous… If you don’t run as root, you’ll be happy if your kid goes on this URL and YOU don’t loose your data.

Also with all this system you’re absolutly sure that an update will work (on good distro) and that your system will be patched exactly the way it should. Think about problem of SP2… Why? Because you didn’t have any way to mess up this OS!

Running as root would be dangerous in most enterprise config when using NFS for example. On a real network, each user is unique.

For teh example about the clock time setting. Changing the clock will change the clock for any user that are working on the system, so this clock is not only for you, but also for any users logged on the system. And on Linux, there’re plenty of virtual users which launch process in the backgroud. All those processes could be disturb while changing the date. Also, setting the good time on a computer is not a day to day action. And this example is not a good example at all, because the date is set by the network on current distribution. There’s only Windows which doesn’t set it directly out of the box. Why? Because the time is not set to GMT… It’s exactly a demo why the begginer should not interfere with the choices made by computering engeneers… When you receive mail outdated on your box, they doesn’t sort correctly. So, the computers HAVE to be on time, and it’s not to the user to change the time.

Also, for the program which are really usefull for day to day use, there’s the SUID bit. Also, on Ubuntu/OSXTiger, this root user doesn’t even exist and the user is asked his own password… So he doesn’t even now that there’s a root user! It’s just a question of PAM configuration.

So, please see pam and sudo and you’ll see how running as a privileged user is really cool! When you’re asked for your password : you can ask yourself : “Am I dooing something wrong?” “Did I made an error”… Have a look at Ubuntu (I’m sure there are other distrib that come with sudo confiigured but this one is very integrated) and see how security can meet ease of use…

Linux is different in design from Windows : You rarely have to download a program yourself, there’re package management such as urpmi or dpkg to do that. If the user have to install a program himself or compile it, he’ll know what he is doing… And he’ll know why using a Linux day after day program as root is not allowed.

Running as root is like use your new home DVD player without the plastic protection… To sum up!

Linux is about security and stability. That’s the big difference with windows : It’s thought by all.
If Lindows no, Linspire, is made with this kind of breach in security, I prefer Windows… Because at least after the fighting against spywares… I can play a lot of games in Windows! lol!

]]> By: daveb http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-235 daveb Tue, 03 Jan 2006 16:56:55 +0000 http://www.newlinuxuser.com/?p=122#comment-235 Honestly, the most compelling reason for me to run my day-to-day tasks as a non-priviliged user is to limit my ability to screw things up. I've only been using Linux-based operating systems for a little over a year, so in many cases, I'm stumbling along or flying blind. I'm thankful for any roadblocks to prevent or lessen my ability to shoot myself in the foot. Also, by using a non-priviliged account, when I do have to run as root, I don't do it flippantly. Honestly, the most compelling reason for me to run my day-to-day tasks as a non-priviliged user is to limit my ability to screw things up. I’ve only been using Linux-based operating systems for a little over a year, so in many cases, I’m stumbling along or flying blind. I’m thankful for any roadblocks to prevent or lessen my ability to shoot myself in the foot. Also, by using a non-priviliged account, when I do have to run as root, I don’t do it flippantly.

]]> By: Jon http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-175 Jon Fri, 09 Dec 2005 23:56:08 +0000 http://www.newlinuxuser.com/?p=122#comment-175 You're probably right. This is just all speculation on my part but it seems to me that many viruses propogate via tcpip connection. Therefore, I imagine that a virus looking to propogate will send itself to any ip address it can find and if the machine at that address happens to fit the bill, it will be able to install. Now, whether it will be able to execute enough in order to start the propogation is another story. Pure speculation.... You’re probably right. This is just all speculation on my part but it seems to me that many viruses propogate via tcpip connection. Therefore, I imagine that a virus looking to propogate will send itself to any ip address it can find and if the machine at that address happens to fit the bill, it will be able to install.

Now, whether it will be able to execute enough in order to start the propogation is another story.

Pure speculation….

]]> By: Jeff http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-174 Jeff Fri, 09 Dec 2005 22:29:30 +0000 http://www.newlinuxuser.com/?p=122#comment-174 That's true, there are a number of ways to get viruses. Simply going to some websites will install a virus. I may be wrong, but for a linux computer to pass a virus to a windows computer, as mentioned by Mark Rais, I think that an email attachment is the primary threat. Other than that, maybe a tainted mp3 recording. Since most linux applications don't run on windows, what else would there be? If you know of others, please let me know. That’s true, there are a number of ways to get viruses. Simply going to some websites will install a virus. I may be wrong, but for a linux computer to pass a virus to a windows computer, as mentioned by Mark Rais, I think that an email attachment is the primary threat. Other than that, maybe a tainted mp3 recording. Since most linux applications don’t run on windows, what else would there be? If you know of others, please let me know.

]]> By: Jon http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-173 Jon Fri, 09 Dec 2005 19:28:46 +0000 http://www.newlinuxuser.com/?p=122#comment-173 Hi Jeff, There are lots of ways to pass viruses, email is just one of them. I'm not even sure that it's accurate to say that 'most' viruses are passed via email. Many worms and zombie applications spread through the network without using email. Hi Jeff,

There are lots of ways to pass viruses, email is just one of them. I’m not even sure that it’s accurate to say that ‘most’ viruses are passed via email. Many worms and zombie applications spread through the network without using email.

]]> By: Jeff http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-172 Jeff Fri, 09 Dec 2005 19:02:50 +0000 http://www.newlinuxuser.com/?p=122#comment-172 I think Ben hit the major benefits for running as a nonprivilaged user. The biggest risks of running as root is that a hacker could modify your computer without your knowledge. Spyware could be installed, rootkits, or the computer could be turned into a "bot" and be used in conjuction with other computers to make mass emailings or flood websites and shutting them down. You can run as a limited user in windows, making it very similar to using linux. By right clicking on a program, you will be prompted to enter a password and get administrator rights. However, windows defaults to administrator during the install process for ease of use. As far as linux computers giving windows computers viruses, that is unlikely since most viruses are passed by opening suspicious emails. Why would a linux user pass a suspicious email to a windows user? I think Ben hit the major benefits for running as a nonprivilaged user. The biggest risks of running as root is that a hacker could modify your computer without your knowledge. Spyware could be installed, rootkits, or the computer could be turned into a “bot” and be used in conjuction with other computers to make mass emailings or flood websites and shutting them down.

You can run as a limited user in windows, making it very similar to using linux. By right clicking on a program, you will be prompted to enter a password and get administrator rights. However, windows defaults to administrator during the install process for ease of use.

As far as linux computers giving windows computers viruses, that is unlikely since most viruses are passed by opening suspicious emails. Why would a linux user pass a suspicious email to a windows user?

]]> By: Jon http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-171 Jon Fri, 09 Dec 2005 15:40:15 +0000 http://www.newlinuxuser.com/?p=122#comment-171 Ben: Yup, all good points. The more I talk about this subject the more I think that perhaps everyone involved doesn't share the same definition of 'security'. Some people (and this is where I fall into) feel that security goes much farther than simple protection of your data, it extends to ensuring that my machine isn't being used by others to cause problems on the network. Others feel that security simply means the safeguarding of your files. In either case, you've covered off both areas in your three points. Oh, and technically I don't think Linspire actually tells people run as root. They just don't 'guide' people to not do so. Kyle: No, I think you're right. As I wrote above to Ben, I'm concerned about more than just my data though. Ben: Yup, all good points. The more I talk about this subject the more I think that perhaps everyone involved doesn’t share the same definition of ’security’. Some people (and this is where I fall into) feel that security goes much farther than simple protection of your data, it extends to ensuring that my machine isn’t being used by others to cause problems on the network. Others feel that security simply means the safeguarding of your files.

In either case, you’ve covered off both areas in your three points.

Oh, and technically I don’t think Linspire actually tells people run as root. They just don’t ‘guide’ people to not do so.

Kyle: No, I think you’re right. As I wrote above to Ben, I’m concerned about more than just my data though.

]]> By: Kyle http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-170 Kyle Fri, 09 Dec 2005 14:35:56 +0000 http://www.newlinuxuser.com/?p=122#comment-170 Not to beat this horse more, but it seems to me that it is a lot easier to backup just your home folder than it is to backup the entire system. I see what he's saying about the only valuable thing being your data, so who cares about the rest... but heck, you could log in as root once a week, make a copy of your data into the root directory and log back out. That way there'd be a backup of all your personal data right there on the drive that nobody could touch without root privledges. Assuming my noobish understanding isn't failing me here. Not to beat this horse more, but it seems to me that it is a lot easier to backup just your home folder than it is to backup the entire system. I see what he’s saying about the only valuable thing being your data, so who cares about the rest… but heck, you could log in as root once a week, make a copy of your data into the root directory and log back out. That way there’d be a backup of all your personal data right there on the drive that nobody could touch without root privledges.

Assuming my noobish understanding isn’t failing me here.

]]> By: Ben http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-169 Ben Fri, 09 Dec 2005 13:10:51 +0000 http://www.newlinuxuser.com/?p=122#comment-169 Jon, OK I can think of a few good reasons .. logging in as a normal user will stop you from: - deleting system files (accidently or not) - having software silently install on your PC without your knowledge - accidently change system settings that might cause instability In each of these cases you would be prompted for the root password. I think of it this way: If you have a PC in your family home which is logged in as a 'normal' user, you can let your kids or little brother loose on it, and the worst they could do is mess up your desktop settings which should be easy enough to recover from. Would you leave it logged in as root (as Linspire say)? It could get trashed quite quickly! Jon, OK I can think of a few good reasons .. logging in as a normal user will stop you from:

– deleting system files (accidently or not)
– having software silently install on your PC without your knowledge
– accidently change system settings that might cause instability

In each of these cases you would be prompted for the root password.

I think of it this way: If you have a PC in your family home which is logged in as a ‘normal’ user, you can let your kids or little brother loose on it, and the worst they could do is mess up your desktop settings which should be easy enough to recover from. Would you leave it logged in as root (as Linspire say)? It could get trashed quite quickly!

]]> By: Jon http://www.everyjoe.com/newlinuxuser/the-free-world-day-to-day-operations-as-root/comment-page-1/#comment-168 Jon Fri, 09 Dec 2005 12:45:26 +0000 http://www.newlinuxuser.com/?p=122#comment-168 Hi Ben, True, it does go against best security practices. However, MR seems to be right - nobody so far in this discussion (or the one on the board - link in the entry) has been able to give a compelling reason *why* it's more secure to run as root on a home system. I've come up with one scenario, but nobody else has :) Hi Ben,

True, it does go against best security practices. However, MR seems to be right – nobody so far in this discussion (or the one on the board – link in the entry) has been able to give a compelling reason *why* it’s more secure to run as root on a home system.

I’ve come up with one scenario, but nobody else has :)

]]>