Slashdot Mirror
Root 101 - Concept of Root for Newbies
Fozz writes "One of my colleagues wrote this article explaining the concept of root/super user for Unix newbies. He wrote it after looking for information like it and not finding much. His analogy of Unix and an apartment complex is one of the best metaphors I've seen for understanding multi-user OSes." If you're running any variety of Unix, you've probably been forced to learn this pretty well already, but this is a very lucid explanation to point out to curious friends / co-workers who aren't so sure.
It is the CLI of unix that gets people every time - there is no way to explain that it is generally easier to do stuff through a cli
ifconfig for example - I can rememeber the ifconfig line for any computer on my network and have it in and done in seconds
But in windows it takes a few minutes just to click click click
The article says that only root can "Start and stop background processes". Any user can do that, but only root can start and stop processes belonging to other users. Perhaps that is what he meant?
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
Well, if someone needed it they'll know how to search and find out, but then, stating it right away in a "beginner" introduction only brings interest to script kiddies to *hack* the password.That's more of an eye opener than a warning.
Thanks for reading,
Khalid
"What you 'seek' is what you get!"
That would be really worthy of Slashdot.
The one thing that appears to be missing is the section "Why shouldn't I run as root all the time if I'm the only one using my system." In your house (comparing your single user system to your house) nobody can control you like a puppet. Somebody can't move your arms and legs and force you to take a sledgehammer to the hot water heater. If you are running Unix as root, any code that you run could make you do just that. It's worth protecting yourself against virii by not running as root.
...but at my shop, everyone enters the building using the concierge's key (administrator), a copy of which is conveniently taped to the front door. (Post-It [TM] to the monitor). We have not, however, gone so far as to include the password in our Telnet greeting -- you'll have to sniff for that yourself.
Um, yeah. Hey! NTFS has default journaling and no 15-minute filesystem checks!
Proudly serving Satan since ought-two.
When you use sudo, you will be asked for a password. But it's your own password, not the admin password. Also, you'll have to be configured with sudo access to run the command you're requesting. And your admin will be emailed if you try to do something you're not allowed to do.
I can't say that I don't give a fuck. I've just run out of fuck to give.
This piece deserves a companion article: what Microsoft did wrong. It is utterly impracticle to use anything other than an Administrator account when running windows (despite the vulnerabilities this leaves you open to) because over half of the useful programs out there, including many titles by Microsoft itself, require Administrative access unnecessarily. The breakdown of privledges is much more distinct in the *nix world. Windows has a long way to go.
This Sig Kills Fascists
You don't really need to restart your machine to set up the root account under OS X... there's a menu option in one of the NetInfo configuration apps to "Enable root account". Much easier than rebooting the machine, heh.
TANSTAAFI: There Ain't No Such Thing As A Free iPod.
Not to start a flame fest here, but isn't a single 'superuser' entity, which has special-case security (e.g. has automatic ownership and access to all files regardless of permissions), indicative of a mis-designed security architecture?
What about capabilities, or mandatory access controls? Or some sort of framework that incorporates root privelages, instead of setting them aside as a special case. I've never been comfortable with the idea that the security system was only for "normal" users and didn't apply to a specific user called 'root' (or id 0), which, if compromised, you are entirely hosed.
It's 10 PM. Do you know if you're un-American?
Slashdot: news for clueless newbies. Stuff that makes you think you're a l33t ninja hacker.
Next we can try more difficult tasks, like explaining command mode in vi.
-Sean
I want to use Linux. I want to use a command line. I want to know how to add and remove programs. I want to know how to add and remove hardware refences in the kernal. I want to know how to access my data. I want to know what programs are on my system, and what they do. I want to find programs that do specific tasks. I want these and a whole lot more. And I want it all in an easy to UNDERSTAND reference guide.
I know everyone says "Switch to Linux! It's more powerful and stable then Windows, and it free!" But I have tried several times to switched, and everytime I do something goes wrong. I can't get the sound to work. I can't get my network card to work. I can't get the proper video drivers installed. I can't get it to boot up properly. Whatever. And everytime, I install Windows, spend an hour or two setting up my programs and getting everything, and I'm done. I'm using my system. I have never had that with Linux.
Basically, I want a Linux system that's as easy to install and use as Windows. I would love to learn how to use Linux properly. But I can't seem to learn it. And I've had to learn how to use an AS/400 system. Even that was easier to do then learn Linux. And I'm a programmer. It's not like I'm some dumb schmuck who thinks Windows is the best thing in the world. So until you can give me a Linux system that I can learn, or give me a better way to learn it...then you'll have problems getting the mainstream users.
...was to see that users like my parent couldn't care less about security. Anything that hinders them in doing what they want to do is considered a nuisance.
I am also having a hard time explaining to my wife why I have revoked most priviliges for the "Internet zone" in IE (yes, I prefer Phoenix too, but the sad fact is, that there are many sites that won't work unless you use IE) - somehow it is still to much of a bother to add sites that we trust to the "trusted site" list the first time we visit them.
Maybe you just need to get burned once to respect fire (and of course understand what happened). Within the first 48 hours of my job as a student programmer I managed to wipe all files of several projects - my current directory wasn't what I thought is was and I had become more priviliged than I should be. That day I learnt not to invoke all priviliges in the login-script but only as needed. I also learnt something about proper backup routines that day - the nightly backup really saved me (thank you dear sysadmin for saving my from the wrath of my colleges...!).
Oh - that reminds me of another story. As student programmers we were given group-privileges (this was VAX/VMS). It was very practical to be able to start and stop job on behalf of other student programmers etc. Once one of the other student programmers wrote a utility that would log you out every interactive session wherever you where logged in (which was rather handy when someone asked if you would like to come along for beer). The utility stopped all interactive processes that it could find, but the author remembered to explicitly turn of our group priviliges before doing so, so we didn't accidentially log each other out. Somehow our sysadmin got hold of this utility and since it was throughly tried and tested by us for several months, he trusted it. One crusual difference between a student programmer and a sysadmin is that a sysadmin has world-priviliges and the script didn't turn these of...! He learnt the hard way that as a sysadmin you should trust noone.
When we asked above mentioned sysadmin for more privileges ("can I have oper-privileges so I can restart this print-queue?!?") he always answered "Do you want more responsabilities?" No, we only wanted more privileges. "Well" he said "it is the same thing - do you still want your privileges?" Somehow it wasn't really nessecary with more privileges anyway. And that is perhaps one of the most useful lessons to be learnt.
One thing that would be nice would be some sort of suid functionality, so I could tag a file to always run as a certain user no matter who it was executed by. That way I could selectively trust certain applications
/user:administrator /savecred <program>
I think you can do this (on XP) with the RUNAS command.. Something like:
runas
Throw that into a shortcut, enter the password once, and you're all set. Don't ask me where it's storing that password though.....
Just wanted to let everybody know that the "Root 101" article has been updated on the Iodynamics site. Most of the revisions are based on the comments above.
I appreciate all of the great feedback, both here and via e-mail. This article has truly been a community effort.
--DaveYou can't use the "Run As" option on the shortct properties.. You have to use the command-line RunAs.exe utility with the /savecred parameter every time you're launching the application. So you might do something like:
/user:administrator /savecred "c:\program files\Internet Explorer\iexplore.exe"
/user:domain\administrator /savecred "c:\windows\system32\mmc.exe \"C:\Program Files\Microsoft ISA Server\MSISA.MSC\""
runas
The first time it would prompt you, but after that it would just load. You have to put that whole command line into a shortcut if you want to launch it from an icon or the start menu. You can nest quotes inside the command line with a backslash - I use this on a shortcut to launch the ISA administration console:
runas.exe
A couple of links:
Hope this helps