[CONFIGURATION] Having no root login

[xennex81]

I would warn about not setting a root login password.

I accidentily removed myself from the sudoers group by doing: usermod -G <newgroup> instead of usermod -G <newgroup> -a so it did not add me but instead removed me from all other groups.

Take care to have your root password and make sure you don't accidentily wipe yourself from the sudoers group if you don't.

The group is really called "sudo".

But your root access rights depend on that single thing.

When you are removed from sudo, it will start asking you for your root password instead of the user password. That is the sign that it is not going well.

It is hard to see the difference because group changes only affect newly logged in users. So beware.

[vinnywright]

pleas read this ,,,,,,if you are @hear reading this

https://help.ubuntu.com/community/RootSudo

VINNY

[xennex81]

The risk of ruining your system should not be a great risk if you are a new user to Linux. You will not have data set up and so the risk of losing data is very small.

I have had people (actually, it was one person) come at me wanting to have perfect safety in using Linux. This person wanted to install Ubuntu but he wanted a personal side-kick in case trouble arose. In that case they are best off staying away from Linux, even if it is Ubuntu.

While I believe not having to set two passwords during the install (or in any case) is appreciated by many, and also by myself, I consider a normal root prompt to be essential.

I think the reasons for dissuading root login are disingenuous. They are just meant to prevent a support nightmare, the way many commercial vendors refuse to give insight into the system for fear their system will be used or modified by users that then come back to them with support requests.

Just my point of view. Sure i can do sudo -i or sudo -s. But I did learn something from that page:

To repeat the last command entered, except with sudo prepended to it, run:

sudo !!

But really, the crowd for Ubuntu is being misread. A regular computer user cannot become a Linux adept. Not the way it is constructed. Kubuntu is nearing that where the hostile nature of it is fading away or being replaced (by more friendliness) but that is mostly in terms of community (and KDE) (which is much better than Unity imo). Ubuntu is too commercial (and perhaps too big) to become a nice community.

[xennex81]

If being hacked is truly a risk, and it could be, there are two things that provide defense instead of disallowing root login:
- not allowing root ssh
- being behind a NAT

And also:
- changing the name of the root user. This could simply be a user that has sudo access, but it is not necessary for me. I always or usually become root by doing "sudo su". It is handier to type than "sudo -s". Sudo happens so many times for me, so very often, that I often become frustrated with forgetting it.

Having to type Sudo for every little command is not done, it is a no go , a nono. It doesn't work. Not for me at least, but I doubt for anyone. I do so many things that require root privileges (because of the way Linux is set up, e.g. I cannot even mount something under my own directories if I am not the root user, such as a LUKS container). It is hateful to not be able to become root, but also that you need root so often.

Becoming not root but admin (and require no password) and admin can do most of the things that cannot destroy a system, would be very nice. Something of that kind.

[claydoh]

I dunno, Ubuntu having done things this way for 10 years, and with the huge number of people using it this way, and not even counting the other distros that use it, you would think that if setting things up this way was so terrible and wrong that people would run away in droves. Obviously, they are not.

One can easily enable the root account, the info is extremely easy to find.
One can also study a little about how sudo (and I believe policykit) can be set up, and realize that it is very powerful and you could set it up to do exactly what you want.
You just need to decide which commands/applications that need elevated privileges are actually safe to run as a normal user.

Here are a couple of examples:
http://askubuntu.com/questions/74054...t-without-sudo
http://askubuntu.com/questions/3/how...-for-non-root-

[xennex81]

10 years is not a very long time. I have been using Linux for (much) longer than 10 years. And I'm not saying that it's such a terribly bad thing, and it is also not true that everyone would be wanting to do it the Ubuntu way, just that Ubuntu (apparently, if such a thing would be a person or a group) WANTS people to do it that way, to dissuade them from doing it the normal way, because it will end in a support nightmare for them (if it is a person). So it is not that the reality is that "Ubuntu" has been doing it this way for 10 years because Ubuntu is not all those people that use it.

There is just a group of people behind Ubuntu and they don't want OTHER PEOPLE ruining their systems (fear fear) because it would blemish the Ubuntu brand and give rise to support bad dreams.
This is not reality. Reality is that a root account is very handy if you do any amount of customization. Remember, if I hadn't given my root a username (It is not even locked, it just doesn't have a password) but you want a username that you can use as a login (in this case it is "root") I would have locked myself out of changing anything on my system. For what it is worth: I used sudo usermod -G .... to change my privileges and this sudo command would have caused me to get dropped from having any privileges at all. So sudo does not protect you from nightmares; the fear and risk of getting "hacked" or "hax0red" is very small, there are typically no risks involved with a root user unless you are not behind a firewall/NAT although I am not comfortable with having my own "roots" exposed like that.

But it depends on who you are and where you're at. Personally I feel having a backdoor for yourself is a must, that's all.

Also, try to read "man sudoers". Count on a few days of study before you know anything about it? It is way too complex, the help file itself is too complex to read.

[claydoh]

Having to type Sudo for every little command is not done, it is a no go , a nono. It doesn't work. Not for me at least, but I doubt for anyone. I do so many things that require root privileges (because of the way Linux is set up, e.g. I cannot even mount something under my own directories if I am not the root user, such as a LUKS container). It is hateful to not be able to become root, but also that you need root so often.

You are projecting your needs and use case as if they are those of most users out there, which is wrong.


If you truly are constantly using sudo in a terminal, then sudo -s may be your friend.

[claydoh]

10 years is not a very long time. I have been using Linux for (much) longer than 10 years. And I'm not saying that it's such a terribly bad thing, and it is also not true that everyone would be wanting to do it the Ubuntu way, just that Ubuntu (apparently, if such a thing would be a person or a group) WANTS people to do it that way, to dissuade them from doing it the normal way, because it will end in a support nightmare for them (if it is a person). So it is not that the reality is that "Ubuntu" has been doing it this way for 10 years because Ubuntu is not all those people that use it.

There is just a group of people behind Ubuntu and they don't want OTHER PEOPLE ruining their systems (fear fear) because it would blemish the Ubuntu brand and give rise to support bad dreams.
This is not reality. Reality is that a root account is very handy if you do any amount of customization. Remember, if I hadn't given my root a username (It is not even locked, it just doesn't have a password) but you want a username that you can use as a login (in this case it is "root") I would have locked myself out of changing anything on my system. For what it is worth: I used sudo usermod -G .... to change my privileges and this sudo command would have caused me to get dropped from having any privileges at all. So sudo does not protect you from nightmares; the fear and risk of getting "hacked" or "hax0red" is very small, there are typically no risks involved with a root user unless you are not behind a firewall/NAT although I am not comfortable with having my own "roots" exposed like that.

But it depends on who you are and where you're at. Personally I feel having a backdoor for yourself is a must, that's all.

Also, try to read "man sudoers". Count on a few days of study before you know anything about it? It is way too complex, the help file itself is too complex to read.

I have been using linux for longer than 10 years as well, and think this setup is a sane one for most desktop users.

Who reads man pages? I searched for actual usage examples, which for me aids understanding.

You also forget the recovery mode option in grub, which has a root terminal. The back door we all have.

Again, you can easily set up root as you wish, there is nothing stopping you. We have a set of defaults, those can be changed.

[vinnywright]

Remember, if I hadn't given my root a username (It is not even locked, it just doesn't have a password) but you want a username that you can use as a login (in this case it is "root") I would have locked myself out of changing anything on my system. For what it is worth: I used sudo usermod -G .... to change my privileges and this sudo command would have caused me to get dropped from having any privileges at all. .

you would not have locked your self out of your system ,,,,,,you can always login to recovery mode through grub and get a root shell and even though it is read only you can get read write with

mount -o --remount rw /

+ if you were in a root terminal/console you would have done usermod -G bla bla your username.... to change your privileges anyway and had the same situation.

and yes I remember

and having a root login without a password (I hope I misunderstood you hear) .......is insane I hope you dont use SSH

"hax0red" ,,,,, LOL

VINNY

[xennex81]

You are projecting your needs and use case as if they are those of most users out there, which is wrong.

No you are projecting your ideas of what a desktop user is and what she needs onto those users and everyone else as well. There's a difference. There is not even a "most users", everyone is different. The idea that people need to be protected against themselves is just nonsense. This way you are ensuring that people do not grow up because you are parenting them.

Ever wonder why we have such an immature world? It's because of all the parenting going on all the time. No one is allowed to make their own choices. We think we are all so enlightened, and we're not. We're primitives. Barbarians, so to speak.

Leaving people to do as they wish is the most advanced thing you can do.

You want users who can and want to use a Linux system but end up in deep nightmare the moment something goes wrong. That is the bad targeting that Ubuntu does. They want an audience that cannot use Linux and will never be able to use Linux the way this is. You have to work with the basics in order to learn the advanced stuff, but the basics are denied them.

That is not something you can blame ME for, it is the bad Idea Canonical has over which people should be Linux users.

And hence, a bad idea on what Linux IS. You see it all around. All those forums with the Linux wannabes, I don't visit them anymore (it was mostly ZDNet, and in the past, perhaps slashdot and or kuroshin) but there's (or was) a LOT of Linux addicts who really have no grasp of what the Linux system actually is and what users or USES are good for it. Kubuntu is changing that, but Ubuntu is not Kubuntu.

If you truly are constantly using sudo in a terminal, then sudo -s may be your friend.

What about I already have a friend, and it is called "sudo su"? I do not need a way of doing that if I already have it, now do I?

So why are you educating me? You think I need to be educated? Wrong. This is this debilitating thing you do and it doesn't look well on you. Just because I have a different opinion on these things you think you need to belittle me? Wrong again.

Apologies for anything that doesn't come out well.

[xennex81]

you would not have locked your self out of your system ,,,,,,you can always login to recovery mode through grub and get a root shell and even though it is read only you can get read write with

mount -o --remount rw /

So let me get this straight.... you would rather have a new user do a remount -o whatever in order to gain access to his account, than to have an important user (in the sense of being new and not having anything to protect) have an exposed root account that would one day be "hax0red" ? :P. How much more stupid is it to force new people to do that sort of unguided recovery than to have them have some FUN with a root account? ANY new users should PLAY with a ROOT account. ACCOUNT. It is for FUN. Linux is for FUN. But all those people care about is not getting in trouble because there are too many support requests. It is taking things too SERIOUSLY. Linux is not the end of the world and it is not the beginning either. Get a grip on yourself. There is much more than just this stupid system. Okay? Users being married to the ubuntu platform is not the end of the world either. Get some grip on yourself. This is a unix system with people wanting to try it out. Let them try it then. And don't prevent them from learning something.

Now you are asking people do a root login with remount -o rw (or mount o rw,remount) in order to do a passwd <username> and you do not call this advanced? That is the split you people have in learning the difference between what a user should be, and what he really is. Such recovery options can be prevented by not being so strict about the security and treating it more like a learning system than a production system, which is never is, not for anyone (usually). The only reason I am hanging out in Linux is in order to make it better.

Like I said.... I'm having great trouble being any kind of productive in Linux and I doubt there are many users who are really all that productive in it, save for the hackers and the coders. Linux remains something that people do, it is a project. It is nearing completion, as far as I'm concerned, at least in Kubuntu. But this doesn't mean this is all that magical just because some people have decided that it is the end of the world if a user gets locked out or gets hacked or does something silly in a root console. These are pejoratively called "learning experiences" but it is about having fun and some people forget that.

You people are projecting NEEDS onto "desktop users" and those users DO NOT EXIST. It is a fantasy in your mind. The average desktop user that you are talking about DOES NOT EXIST. They are people getting in trouble because the system is too opaque for them to learn anything, because it is being shielded from them "for their benefit".

(Gnome makes this even worse, or worse, because of using graphical names ("Files") that do not match the down names ("Nautilus"). Instead of just calling it Nautilus, they think they need to "help" the user getting acquainted with the system by giving it some idiotic name. The result is that you feel lost because you don't know how to do anything to "Files" since down below it doesn't even exist. Even a process viewer won't show it. What's good to that?)

If you want a Linux user, give him a console and let him work in THAT. That is all that Linux is! Nothing else is the matter with Linux but the shell and the power tools. The graphical applications are still subpar, as compared to Windows. Even Dolphin is subpar to what the Explorer was in Windows 98. Even some shell things are subpar to what I had in MS-DOS in 1992. It is still not user friendly. But I'm working to change that, I hope you too :P. (That is a quote from a movie ;-)).

"The dreamer has become a rare kind, banished to obscurity. No one does it anymore. No one remembers it exists. I'm working to change all that, I hope you are too."

+ if you were in a root terminal/console you would have done usermod -G bla bla your username.... to change your privileges anyway and had the same situation.

No, because being in this freaking root console/terminal means I already have another login (ROOT) that I can easily use to fix this situation because root does not need to be in the SUDOERS file. It is a protective measure! A fail escape. Don't you get that? I have a root login. I cannot remove root from sudo. I can only lose its password or do anything other stupid. But that is just the way it is.

and yes I remember

Good, you are a good boy (or girl) ;-).

and having a root login without a password (I hope I misunderstood you hear) .......is insane I hope you dont use SSH

Yeah, you misunderstood. I would not write these things if I was doing that.

"hax0red" ,,,,, LOL

Well that's how the kiddies call it and I think it is a good way to just frame it ;-).

VINNY

Regards.

[xennex81]

"By dreaming. Every day. Dreaming with our hands, and dreaming with our minds."

That's what we are all here for right? To dream... with our hands and minds.

[kubicle]

Leaving people to do as they wish is the most advanced thing you can do.

Anyone can do as they wish on their linux installation on every distribution I know of. Nothing limits you or anyone else. Want to enable the root account? Go right ahead, it's just one command away. Trash your sudo access by using commands you do not know how to use? Yes it can be done.

You on the other hand are trying to tell others what they should do ("developers should do this and that because that's what users want/need"...an assertion you're not qualified to make. Neither is anyone else, btw, so this is nothing personal against your qualifications).

And yes, open source development doesn't work that way. Those that do the actual work get to decide what they release, not random people on the internet. You don't have to like it, but that's the way it is.

Just for the record, I'm not categorically against enabling the root account, there are cases where it may make sense...but "it should be enabled by default as a safety blanket" is probably one of the worst reasons I've heard in a while. If someone is capable of fixing their issues using the root account, then surely they're also capable of enabling it or get to it in recovery mode (or at least capable of googling for the instructions), they'll probably also learn something in the process.

So let me get this straight.... you would rather have a new user do a remount -o whatever in order to gain access to his account, than to have an important user (in the sense of being new and not having anything to protect) have an exposed root account that would one day be "hax0red" ? :P.

Yes, any day of the week. And it isn't to "gain access to his account", but to "regain access to their account after they did something stupid".

[Chdslv]

Anyone can do as they wish on their linux installation on every distribution I know of. Nothing limits you or anyone else. Want to enable the root account? Go right ahead, it's just one command away.

How true!

With a Live Ubuntu/Kubuntu DVD/USB, you can get into any Linux and Windows installations of any computer. You can change anything, even in the Windows system32. Live DVD/USB is already in root mode, just a "sudo su" away.

[claydoh]

I'll keep this short as I have broken my wrist in two places, and one handed typing is no fun

This is all a design choice, one that can be changed. There are even instructions on how to do so, which include pros and cons for using sudo over root.

If this were such a terrible thing Ubuntu have done, where are the massive number of bug reports with all the maladies that have occurred using this setup?
That is what I meant by my "10 years" statement.

You also seem to be taking our words here much more harshly than they are intended to be. If I make a suggestion, it is simply that, and nothing else. Between this forum and on irc, I do see that you are taking things much in the wrong light.