Revive the "root" account

[daihard]

I realize that Kubuntu make an extensive use of the sudo tool. I see a couple of problems in its implementation. All in all, I personally feel that it's better to use the traditional "root vs. normal user" approach.

One issue is that Kubuntu automatically adds a new user (created via its GUI user manager) to the group named "admin," which has an entry in the sudoers file. That's how every new user can use sudo to perform superuser tasks. However, if you create a new user in another way (i.e. via "useradd") without knowing this mechanism, the new user will have no access to the su privilege because the "root" account itself is locked by default.

Another issue is that the Kubuntu approach (IMO) is inherently dangerous in terms of system security. How safe is it when every user - novice or experienced - has access to the privilege to perform ALL su tasks? It is very easy to render the OS useless by editing some system files incorrectly. That's why the root privilege should never be treated casually... at least IMO.

The main Linux system my wife and I share runs CentOS. She does not know the root password, and she's comfortable with it. That way, both she and I know that if the system gets messed up, it's not her.

I am aware that it is possible to unlock the root account. In fact, I've already done that. As someone who administers 10+ UNIX/Linux servers at work, I am very uncomfortable not being able to "su".

What do you guys think?

[jankushka]

Re: Revive the "root" account

in a world of desktops and laptops, sudo is an absolute necessity.
in a server context, of course, you can easily get by without it.
the vast majority of the installations are "personal".
so, it doesn't make much of a difference whether or not you have a root password.
in those contexts where a pc is shared by more than person, though,
i agree that having to enter the root password provides better security.
you can do that with sudo, though, mac-os style...
m2cts.

[lowey23]

Re: Revive the "root" account

The main Linux system my wife and I share runs CentOS. She does not know the root password, and she's comfortable with it. That way, both she and I know that if the system gets messed up, it's not her.
What do you guys think?

I think that it's never her fault. How long have you been married? Tell her everything, take the blame, what is the matter with you? Not telling "herself" anything is much worse than any root permission problem you may envisage.

Go out and buy her some flowers. Make dinner. Above all, do not show her this post.

[daihard]

Re: Revive the "root" account

in a world of desktops and laptops, sudo is an absolute necessity.
in a server context, of course, you can easily get by without it.
the vast majority of the installations are "personal".
so, it doesn't make much of a difference whether or not you have a root password.
in those contexts where a pc is shared by more than person, though,
i agree that having to enter the root password provides better security.
you can do that with sudo, though, mac-os style...

Thanks for your comments. You've reminded me that Mac OS X uses the same mechanism. (I activated root on my Tiger, though. LOL)

I still wonder about account creation via CLI. Well, I guess those who resort to "useradd" instead of GUI are expected to know what they're doing...

[Snowhog]

Re: Revive the "root" account

man useradd in a console, or man:useradd in Konqueror and you'll learn what you need to know.

[daihard]

Re: Revive the "root" account

man useradd in a console, or man:useradd in Konqueror and you'll learn what you need to know.

I am fairly familiar with "useradd." My concern, as I expressed above, is that creating an account via "useradd" will not add the new user to the "admin" group unless you explicitly choose to via command-line parameters. As the result, the new user will not be able to sudo, and since root is locked, there's no way he/she will be able to perform superuser tasks.

[jankushka]

Re: Revive the "root" account

I still wonder about account creation via CLI.
Well, I guess those who resort to "useradd" instead of GUI are expected to know what they're doing...

or use adduser, tailoring its behaviour in /etc/adduser.conf.
that should (hopefully) do what you need.

[kubicle]

Re: Revive the "root" account

One issue is that Kubuntu automatically adds a new user (created via its GUI user manager) to the group named "admin,"

Actually, kubuntu shouldn't do that. That is 'add a new user to the admin group automatically with the GUI'. And it doesn't on my machines.

Giving users administrative powers is a task that should be done explicitly, not automatically. By default, out of necessity, the first user created during installation is added to the admin group, but not subsequent users created.

[daihard]

Re: Revive the "root" account

or use adduser, tailoring its behaviour in /etc/adduser.conf.
that should (hopefully) do what you need.

That's great stuff. Thanks! I was wondering how to change the upper UID/GID limits for system users. (My UID is 501 on all other Linux machines at home while by default Kubuntu considers it a system user ID.)

Man, I learn new things every day. 8)

[Snowhog]

Re: Revive the "root" account

(My UID is 501 on all other Linux machines at home while by default Kubuntu considers it a system user ID.)

By default, in *ubuntu, only the first user established on the system - the one who did the installation - is part of the admin group. Any other user that is added and that you want to be able to function with sudo privleges, must be explicitly added to this group.

[daihard]

Re: Revive the "root" account

(My UID is 501 on all other Linux machines at home while by default Kubuntu considers it a system user ID.)

By default, in *ubuntu, only the first user established on the system - the one who did the installation - is part of the admin group. Any other user that is added and that you want to be able to function with sudo privleges, must be explicitly added to this group.

Kubicle mentioned that as well. That's obviously my misunderstanding.

However, that has nothing to do with what Ubuntu / Kubuntu considers system user/group IDs. If you create a new user using its system settings tool, it will try to assign a user ID above 1000. In order to display "system" users/groups, you will need to check "show system user/group" checkboxes.

[kbunt]

Re: Revive the "root" account

I don't really like the sudo system. I think this would be the best feature Ubuntu/Kubuntu could add and that is the option of using either sudo or the traditional 'su' (su or root account). Why isn't this implemented? I think more people would give one of the *ubuntus a chance.

I know I started branching off to other Debian-based distros which didn't use sudo. I got tired of always having to type 'sudo' after 'su' didn't work. In addition, I sometimes get help with Linux problems and some of my helpers are not sudo/Ubuntu fans so...

[kubicle]

Re: Revive the "root" account

I think this would be the best feature Ubuntu/Kubuntu could add and that is the option of using either sudo or the traditional 'su' (su or root account).Why isn't this implemented?

Do you mean during installation? One can revive the normal root account fairly easily after installation (although it's not recommended).

I got tired of always having to type 'sudo' after 'su' didn't work. In addition, I sometimes get help with Linux problems and some of my helpers are not sudo/Ubuntu fans so...

You can use 'sudo -i' command instead of 'su' to get a root shell, and if you like, you can create an alias for su -> sudo -i and use 'su' just the same as with a root account.

alias su='sudo -i'

in your ~/.bashrc should do the trick (after starting a new shell or resourcing .bashrc)

Note: 'Safer' way would be to use a different alias like:

alias sus='sudo -i'

As su and sudo's additional options are not necessarily compatible

[Edward78]

Re: Revive the "root" account

I hate it, I used SuSE/OpenSuSE for you & the root system used in that never bothered me, I like it alot better really, I unlocked root here, but the GUI apps. won't take the new root pass.

[Corn Flake]

Re: Revive the "root" account

I hate it, I used SuSE/OpenSuSE for you & the root system used in that never bothered me, I like it alot better really, I unlocked root here, but the GUI apps. won't take the new root pass.

On Kubuntu, kdesu is a symlink to kdesudo. To restore the traditional kdesu do this as root:
rm /usr/bin/kdesu
ln -s /usr/bin/kdesu.distrib /usr/bin/kdesu