Root account or no root account?

[luckyone]

Under what scenario can a computer or a human not be a target? A computer free of data is still useful as a source from which to launch other attacks, if that computer has a network connection. A human who doesn't use a computer under normal circumstances can be an ideal social engineering target. The list is without bounds, really.

Simply put, there are easier pickens than a private Linux computer protected by a router and firewall. I haven't and won't lose any sleep at all over the possibility....and I sleep a lot lately.

[sixonetonoffun]

Great info as always Steve and James. Yes mainly homegrown and yes pretty amateurish. Simple things mainly on desktop where I have more services to manage and haven't spent much time lately . I've become lazy of late. I mainly browse and surf where I used to develop and share. Users no longer want personal web spaces. Fbook is all anyone cares for and if its outside of there... it couldn't be relevant to them. Ok maybe thats a little harsh somewhere along the line I just lost interest. E commerce still interests me but I have nothing for it at the moment... Many of the guys I used to FOSS with are now hooked on Android and IPhone apps which just doesn't interest me enough get involved with.

[SteveRiley]

Of course you need to be a target also. But I appreciate the heads up.

Under what scenario can a computer or a human not be a target? A computer free of data is still useful as a source from which to launch other attacks, if that computer has a network connection. A human who doesn't use a computer under normal circumstances can be an ideal social engineering target. The list is without bounds, really.

[james147]

Yes james147 but thats already 5 more chars then su <enter>
Like I said my preference. Then there are issues with scripts launching processes as su that have to be tweaked to repect sudo. Not looking to debate the security merits of sudo. But I would prefer to have a choice at setup. Would a choice not be acceptable?

Then:

alias su='sudo -i'

Now its the same number of chars or

alias s='sudo -i'

Now it is one less

Also:

sed -ri "s/su -c ?([\"']?)(.*)\1/sudo \2/" scriptname

will help to convert your scripts

But I have not come across a script that uses su instead of sudo on the internet, so it is only scripts you have written that you need to worry about and so it should not be hard to convert them.

The best scripts should check for sudo and fall back to su if it is not found:

asroot() {
    if which sudo &> /dev/null; then
         return sudo $@
    else
         return su -c "$@"
    fi
}

asroot command --you --want --to --run

That is the better way to write a script as it is portable between the different distributions.

And you can always re-enable the root account with one simble command if you need to... there is no point in a installer option since if you are going to use su, then you should be comfortable with re-enabling the root account on the command line anyway.

But I wouldn't remove sudo as there are scripts out there that do use it.

[SteveRiley]

I'm not a fan of sudo. I like to be able to open a terminal and run as root for updates ect... the timeout of sudo usually requires entering the password more then once per session. I think sudo is mainly designed to protect us from ourselves. I know the length of time or user could be modified but its something that could be addressed during setup IMHO.

I like having to sudo because it's simply good practice to use elevation only when needed. The extra sudo step ensures that I'm not running elevated when I don't need to be.

Conversely, I loathe the password timeout, so I configure my sudoers not to prompt for a password. To do this, run:

sudo visudo

In the editor, make the changes shown in underlined bold:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) [B][U]NOPASSWD:[/U][/B] ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) [B][U]NOPASSWD:[/U][/B] ALL

I'm not worried about any security implications here because if a bad guy has access to my computer, privilege escalation isn't too high on my list of things to be concerned with.

[oshunluvr]

You do have the choice: Once installed, enter a root password.

With the literally thousands of options that KDE and linux offer, some lines need to be drawn. Having hundreds of options during each install would be untenable.

[sixonetonoffun]

Yes james147 but thats already 5 more chars then su <enter>
Like I said my preference. Then there are issues with scripts launching processes as su that have to be tweaked to repect sudo. Not looking to debate the security merits of sudo. But I would prefer to have a choice at setup. Would a choice not be acceptable?

[james147]

I like to be able to open a terminal and run as root for updates ect...

You mean like

sudo -i # equivalent to su -

Sudo can do everything su can and more...

[sixonetonoffun]

I'm not a fan of sudo. I like to be able to open a terminal and run as root for updates ect... the timeout of sudo usually requires entering the password more then once per session. I think sudo is mainly designed to protect us from ourselves. I know the length of time or user could be modified but its something that could be addressed during setup IMHO.

[luckyone]

Of course you need to be a target also. But I appreciate the heads up.

Reminds me also that there are limits to the number of characters for some situations. I remember a distro that would allow a bunch of characters, but would only use the first 6.

[james147]

For these reasons, length is always better than complexity. Every character you add to a password exponentially increases its durability. Wherever possible, I now recommend using three average-sized native language words separated by some piece of punctuation. This has two benefits: it thwarts precomputed rainbow tables and it's too large of a keyspace to work through in algorithmic attacks.

I believe these are appropriate:

Password strength
Password reuse
Security

[SteveRiley]

On those distributions that have a root account I use a randomly generated 8 digit password. It uses any character on the keyboard. I'm informed that this is reasonably secure outside of governments and large corporations.

An eight-character keyspace is crackable in a reasonable amount of time with contemporary computer hardware. Sophisticated cracking routines look for weaknesses in the intermediate steps used in generating hashes; brute-force routines simply try the entire space as represented by rainbow tables. It is now possible to rent sufficient computing power and storage by the hour to attempt both kinds of cracking.

For these reasons, length is always better than complexity. Every character you add to a password exponentially increases its durability. Wherever possible, I now recommend using three average-sized native language words separated by some piece of punctuation. This has two benefits: it thwarts precomputed rainbow tables and it's too large of a keyspace to work through in algorithmic attacks.

[tek_heretik]

I am fine with sudo but...the constant typing of a pw can be a pain, but it's worth the security, and it can also tempt users to create short and easy passwords, knowing that they will have to enter it a lot. I also find maintaining a separate root account can also be a pain and a headache. Overall, I think it's better to be root only when you need to be. I do have one gripe, when using a distro's software 'shopping' app, most of them require a pw for EVERY new install, this is just ridiculous, makes me switch back to or install synaptic, your pw goes in one time until you are done, no muss, no fuss.

[luckyone]

On those distributions that have a root account I use a randomly generated 8 digit password. It uses any character on the keyboard. I'm informed that this is reasonably secure outside of governments and large corporations.

[james147]

I also know the amount of damage you can do should you use the root account as a normal account, but are you saying you can't do the same amount of damage using your sudo enabled account?

* You can cause allot of damage if you do the wrong thing while logged in as root (or if you run everything with sudo even if you don't need to)

You can do just as much damage with sudo, since they can both do the same things, but I find that if you use sudo you spend less time running in a root shell and so are less likely to accentually rm -rf * a system folder as root if you forget which directory you are in.

I was asking which in your opinion was more secure? Or are they both as secure as each other?

This highly depends on the situation but I feel that both can be secure as each other.