[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: /sbin vs /bin





On Fri, Jul 29, 2022 at 7:08 AM Greg Wooledge <greg@wooledge.org> wrote:
On Thu, Jul 28, 2022 at 11:39:01PM -0500, Igor Korot wrote:
> Open the Terminal
> Become root by running su
> Try to run ldconfig -> "Command not found"
> Try to run /sbin/ldconfig -> execution successful

https://wiki.debian.org/NewInBuster#Changes

  Changes

    The su command in buster is provided by the util-linux source package,
    instead of the shadow source package, and no longer alters the PATH
    variable by default. This means that after doing su, your PATH may
    not contain directories like /sbin, and many system administration
    commands will fail. There are several workarounds:

     *  Use su - instead; this launches a login shell, which forces PATH
        to be changed, but also changes everything else including the
        working directory.

     *  Use sudo instead. sudo still runs commands with an altered
        PATH variable.

        o   To get a regular root shell with the correct PATH, you may
            use sudo -s.

        o   To get a login shell as root (equivalent to su -), you may
            use sudo -i.

     *  Put ALWAYS_SET_PATH yes in /etc/default/su (create it) to get
        an approximation of the old behavior. This is documented in su(1).

     *  Put the system administration directories (/sbin, /usr/sbin,
        /usr/local/sbin) in your regular account's PATH (see
        EnvironmentVariables for help with this).

Logging in as root has become taboo. Sudo is the prefered mechanism for running administrator functions. I have root set to nologin with a null password to force sudo usage. One of the major issues with su root is that in a work environment with more than one administrator you would have to share the root password. Sharing one account provided no accountability as to who actually made changes. I would love to see Debian Bookworm disable root login by default. Root is a security vulnerability because the user name is known so it is easy to launch a brute force attack against the server. 

--
⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀

Reply to: