[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: to allow root logins or not?

Greg Folkert wrote:

On Fri, 2007-04-20 at 15:53 -0500, Default User wrote:
Gee, I hate to ask another question, but - 
During an Etch install, it asks if I want to allow root logins.  If not,
no root account is set up (I guess as a security measure), and all admin
access is done by sudo.  Now I normally do almost all admin work as
sudo, but is there a downside to not having an actual root account.
That is, might there be instances when something really should (or must)
be done in a real root account (not sudo), and with no root account, the
user is "hung up"? 

Not recommended, but possible:

        sudo su -

or if X is needed:

        sudo sux -

Make sure you "sudo aptitude install sux" for the second one.
As I understand the OP's question/statement, the question in the install appears to be whether to create the 'account' for root or not. It apparently does not say it will create an account without login privileges.
Since both 'su' and 'sudo' commands require an account for validation of the user name and determination of privilege, I would assume the root account is in fact created but with a shell such as '/bin/false' or with an 'impossible' password, so as to prevent logging in while still allowing use of either 'su' or 'sudo'.
This would effectively prevent login to single user mode via 'sulogin', since it requires a password.
In those cases where the startup process drops a user into a root level shell without prompting for a password (this can happen very early in the boot sequence, for example if an fsck of / fails and the disk is unreadable), all would be well.
Given that sometimes root level access is required through 'single user' mode, I'd strongly encourage allowing root login. Just be sure to use a very good password and don't abuse the privilege of being root.
If you really want to not have root login, you would need to have a rescue CD or equivalent method of booting the system, to fix anything that couldn't be handled by a normal startup from the boot hard disk. Though these may be quite rare, they can happen. 

Bob

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Reply to: