Re: sudo vs. su (was Re: new to list, new to debian, new to linux)

["Douglas A. Tutty" <dtutty@vianet.ca>]

On Fri, May 22, 2009 at 05:50:28PM -0500, dwain wrote:
> On Fri, May 22, 2009 at 2:16 PM, George <nutndun@comcast.net> wrote:
> 
> > I was a little disappointed being called out on my suggestions in my
> > original post. Obviously the person isn’t a sys admin and from my
> > understanding the whole purpose of sudo is so the user only has root
> > privileges for that given command instead of during the entire terminal
> > session. I personally see nothing wrong with what I suggested other then
> > using visudo to edit the sudoers file instead of vim.
> >
> 
> i too was disappointed.  i tried su and authentication failed.  how do i
> update my system without being able to log in as root?
> 
> now i don't mind a spirited discussion on the pros and cons of sudo vs. su,
> but my original question still has not been answered; and with this new
> development i am really at a loss.
> 
> you are saying that  sudo and su are not available from a user console, then
> how do i fix this so i can become root when i need to?
 

Root login from a secure serial console has been described as the
ultimate command line of last resort.  I always have a serial console
set up in inittab (and in grub too for that matter).  I guess if you
can't log in as root (or otherwise get root), you'll need to boot a live
CD such as grml and fix whatever is preventing you from getting root.  

A last resort would be:

1.	physically disconnect the box from the network.
2.	boot a live CD
3.	edit the password file to allow root login without a password
4.	reboot into the system and log in as root
5.	passwd as root and give yourself a root password.
6.	shutdown
7.	reconnect the box to the network.
8.	carry on as normal.


If you want to use sudo for most things, but have root login available,
put the root password in a card in an envelope in a locked location.
You'll know if someone needed the root password by the tear in the
envelope.  Unless it was removed, the root login should be recorded in
syslog as well.

Doug.