Root login in Linux - does it make sense? Post: 302728539

Sponsored Content

Special Forums Cybersecurity Root login in Linux - does it make sense? Post 302728539 by bakunin on Thursday 8th of November 2012 03:54:46 AM

11-08-2012

Registered User

Quote:

Originally Posted by Corona688

That's what sudo's for -- it gives you the same thing in a less blunt, more careful way.[...]

I have one sudo-enabled user that I use for administrative things. So you're left with the enormous hassle of 5 extra keystrokes per command.

Fair enough. If i understand you correctly this would mean to roll out a single command on my management station might look like this:

Code:

while read WORKHOST ; do
     ssh someuser@${WORKHOST} "sudo su - root -c command"
done < /path/to/hostlist

with someuser being allowed to "su" to root without being asked for a password.

If so: what is the gain of having someuser login and switch to root without further authorization to having root log on directly? It is clear that this just transfers the "risk" from one user to the other.

There is one conceivable point for doing it this way and this is: if a host is under constant attack from bots then these bots will most likely try only "root" because the name of this user account is known. One can use any other non-default name for the "sudo-root-user" and the bots will not even try this name.

This is a valid argument but it is a predicament probably only a very few select systems are in. In most corporate networks this sort of attack is already stopped at the networks entry point.

bakunin

bakunin

View Public Profile for bakunin

Find all posts by bakunin

9 More Discussions You Might Find Interesting

1. Answers to Frequently Asked Questions

Lost root password / Can't login as root

We have quite a few threads about this subject. I have collected some of them and arranged them by the OS which is primarily discussed in the thread. That is because the exact procedure depends on the OS involved. What's more, since you often need to interact with the boot process, the...

2. Linux Benchmarks

Linux Benchmarks Makes No Sense

I created two computers with identical hardware, and run the benchmark programs in both starting at the same exact time. What makes no sense is that the computer that has the lower average index (121) finished the race a good 30 minutes ahead of the computer wich showed the higher avg index...

3. AIX

Can't login root account due to can't find root shell

Hi, yesterday, I changed root's shell in /etc/passwd, cause a mistake then I can not log in root account (can't find correct shell). I attempted to log in single-mode, however, it prompted for single-mode's password then I type root's password but still can not log in. I'm using AIX 5L version 5.2...

4. High Performance Computing

Rocks clusters make sense for educational environments

08-18-2008 11:00 AM Cluster computing has played a pivotal role in the way research is conducted in educational environments. Because the amount of available money and hardware varies between university researchers, often it's necessary to find a clustering solution that can work well on a small...

5. UNIX for Dummies Questions & Answers

a for loop that doesn't make sense

I've been referring bash info for processes and came across a structure for a process which is defined like typedef struct process { struct process *next; char ** argv . . . }process; What I don't understand is that in the program there's a for loop which goes like this job...

6. UNIX for Dummies Questions & Answers

trying to make sense of rsync output...

I'm running the following rsync command to sync a directory between the 2 servers: rsync -az --delete --stats /some_dir/ server_name:/some_dir I'm getting the following output: Number of files: 655174 Number of files transferred: 14221 Total file size: 1138531979331 bytes Total...

7. UNIX for Advanced & Expert Users

sar -d output... does not make sense

Can someone explain the correlation between how sar names the disk drives and how the rest of the OS names the disk drives? sar lists my disk drives as sd0, sd1, sd2, etc..... while format lists my disk drives as c1t0d0, c1t1d0, c1t2d0,etc... And also why sar shows 8 disks but format...

8. Red Hat

How to make a Password-Less Login from Windows to Linux using OpenSSH?

I installed the OpenSSH on my Windows Machine. I want to connect to the remote Linux machine without typing password. I followed the bellow instructions but the SSH needs password to establish the connection yet. Open CMD and run: ssh-keygen -t rsa (The public and private keys are generated in...

9. Red Hat

Does it make sense to reduce the total shared memory

We have several dozen Redhat 5, 6 and 7 servers that are running Oracle databases. On some databases we are using automatic memory management, which uses shared memory. On other databases we are use manual memory management, which does not use shared memory. When I see that a server is swapping...

LEARN ABOUT SUSE

tgkill

TKILL(2)						     Linux Programmer's Manual							  TKILL(2)

NAME

       tkill, tgkill - send a signal to a thread

SYNOPSIS

       int tkill(int tid, int sig);

       int tgkill(int tgid, int tid, int sig);

DESCRIPTION

       tgkill()  sends	the  signal  sig to the thread with the thread ID tid in the thread group tgid.  (By contrast, kill(2) can only be used to
       send a signal to a process (i.e., thread group) as a whole, and the signal will be delivered to an arbitrary thread within that process.)

       tkill() is an obsolete predecessor to tgkill().	It only allows the target thread ID to be specified, which may result in the wrong  thread
       being signaled if a thread terminates and its thread ID is recycled.  Avoid using this system call.

       If tgid is specified as -1, tgkill() is equivalent to tkill().

       These are the raw system call interfaces, meant for internal thread library use.

RETURN VALUE

       On success, zero is returned.  On error, -1 is returned, and errno is set appropriately.

ERRORS

       EINVAL An invalid thread ID, thread group ID, or signal was specified.

       EPERM  Permission denied.  For the required permissions, see kill(2).

       ESRCH  No process with the specified thread ID (and thread group ID) exists.

VERSIONS

       tkill() is supported since Linux 2.4.19 / 2.5.4.  tgkill() was added in Linux 2.5.75.

CONFORMING TO

       tkill() and tgkill() are Linux-specific and should not be used in programs that are intended to be portable.

NOTES

       See the description of CLONE_THREAD in clone(2) for an explanation of thread groups.

       Glibc does not provide wrappers for these system calls; call them using syscall(2).

SEE ALSO

       clone(2), gettid(2), kill(2)

COLOPHON

       This  page is part of release 3.25 of the Linux man-pages project.  A description of the project, and information about reporting bugs, can
       be found at http://www.kernel.org/doc/man-pages/.

Linux								    2008-10-01								  TKILL(2)