Slashdot Log In
Root 101 - Concept of Root for Newbies
Posted by
timothy
on Thu Feb 27, 2003 12:22 PM
from the to-bookmark-for-friends dept.
from the to-bookmark-for-friends dept.
Fozz writes "One of my colleagues wrote this article explaining the concept of root/super user for Unix newbies. He wrote it after looking for information like it and not finding much. His analogy of Unix and an apartment complex is one of the best metaphors I've seen for understanding multi-user OSes." If you're running any variety of Unix, you've probably been forced to learn this pretty well already, but this is a very lucid explanation to point out to curious friends / co-workers who aren't so sure.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
CLI (Score:2, Insightful)
ifconfig for example - I can rememeber the ifconfig line for any computer on my network and have it in and done in seconds
But in windows it takes a few minutes just to click click click
Re:CLI (Score:2, Informative)
Re:CLI (Score:3, Insightful)
Sometimes the command line can save even more time, not just because you don't have to search poorly-layed-out GUIs for the option you want. For example, the other day I got really sick of having about 50 "incomplete" MP3s in my playlist. Rather than going through and deleting all the files one by one, I fired up Cygwin (which gives you a shell on Windows... quite handy!) and did "rm __INCOM*" to delete the countless files beginning with "__INCOMPLETE__" Nice and handy.
Not to mention the remote access aspect of the command line. I'm responsible for maintaining a webserver running Linux; it's so handy to be able to pull up an ssh session and do whatever needs to be done. Let's see the admins of the Windows boxes neighboring it work on their servers from home.
Anyway, I may have just bored everyone to death, but for those just getting into Linux/UNIX, don't fear the command line! If you take the time to learn it, you'll grow to love it.
Re:CLI (Score:4, Insightful)
Not to mention the remote access aspect of the command line. I'm responsible for maintaining a webserver running Linux; it's so handy to be able to pull up an ssh session and do whatever needs to be done. Let's see the admins of the Windows boxes neighboring it work on their servers from home.
---snip
It's not difficult to setup ssh on windows, and redirect the io of cmd.exe (or most any other CLI shell available for windows, come to think of it) through it if you know what you are doing. The problem isn't so much the OS, it's the type of admins the OS attracts. 90% of windows "admins" do not know how to use the cli and cli apps included with windows, or even use many of the graphical management tools included to their full extent.
With NT 5 native RDP support was added, although you have been able to make any NT machine support RDP for awhile now, (assuming you do not need multi-user support; in that case your stuck with their terminal server distribution, or purchasing something re-written by Citrix and dumping RDP for their protocol), and with NT 5 they made a telnet server an official part of the distribution (not that I would suggest using it). Of course, you could do all this years ago with NT 4 as well...(and with NT 3.5x with a little adaptation, probably).
BUT...do many NT "admins" know how to do this, or even have the slightest clue about where they would go to get started? Nope. And from what I have observed, in more than a few places having a _little_ more knowledge about the OS they "support" would have made their lives a lot easier...but they don't bother, they just keep slogging on with what little knowledge someone force fed them at a certification class.
Unix admins on the other hand tend to actually take an interest in knowing what makes their OS tick. Partly that the OS is much more open (for some Unix OS's, you can even get the source code easily). Partly that in the Windows world, the interface to a server appears identical to the interface to a workstation, which gives confidence to users who want to become an admin where they deserve no confidence at all
A good admin can make up for a weakness on any platform, whether it be Netware, Linux, Windows, or Lantastic, without needing to blame his/her tools. A lousy "admin" can also more than compensate for all the strengths of a platform. What matters most is the competency of the admins that tend to work with those systems, not really the systems themselves.
That all said, given a choice, I know which platform is takes me much less effort to secure than the others...heck, you might almost say it is "secure by default"
Parent
Re:CLI (Score:2)
but in my experience, trying to manage windows from the command line is a horrendous task.
---snip
For sure, different OS's are more or less admin-friendly. But difficult is not the same thing as impossible.
Trying to manage windows from the CLI _is_ a much more difficult task than with most other OS's. However, with the right tools you can manipulate the registry database, kill or start a process, manipulate files, or just about anything else you would need to do. In any practical real-world situation you would not hassle yourself with trying to work that way, unless it were a task particularly suited to the command line (automation) or you were in a situation where a CLI was all you had available; remote admin of windows machine is almost always done in a GUI (although many of those GUI tools can be ran locally to manipulate a server remotely over a network).
A good admin _can_ accomplish all the same things, but too often people say "it cannot be done" out of ignorance rather than fact.
Woodworking is a hobby I am just starting out on. Ask me to make a particular type of joint with certain tools, and I will say it is impossible. Ask that of someone who has been working with wood his whole life and knows what he is doing, and he can make it happen. I said the tools were not capable of it, but in fact, it was me.
Re:CLI - Resource Kit = wonderful (Score:2, Informative)
A couple of links:
Hope this helps
Re:CLI - Resource Kit = wonderful (Score:2)
Re:CLI (Score:2)
del ___INCOM*.* actually
Re:CLI (Score:2)
Many distros include a program called "rename" that takes a regular expression search-and-replace type expression and uses perl to rename files passed to it accordingly.
For example:
rename s/^10/20/ 10*
For example for your first example.
rename s/^(..)10/\120/
for the second.. and so on.
It does seem that some distros don't provide this program by default, and you might have to install it yourself tho. Even worse, there is a another rename program that doesn't work anything like this floating around.
Hope I've helped a bit...
Re:CLI (Score:2)
Re:CLI (Score:2)
cmd.exe /? /?
cscript.exe
Re:CLI (Score:2, Funny)
You've obviously never managed a McDonalds.
--R
misleading capabilites of root (Score:5, Informative)
Re:misleading capabilites of root (Score:1, Insightful)
Not a good idea ... (Score:5, Insightful)
Well, if someone needed it they'll know how to search and find out, but then, stating it right away in a "beginner" introduction only brings interest to script kiddies to *hack* the password.That's more of an eye opener than a warning.
Thanks for reading,
Khalid
Re:Not a good idea ... (Score:3, Interesting)
The reason it's in there in a newbie article is that newbies can have the habit of a short memory when it comes to passwords and the like. This I know from experience...
Re:Not a good idea ... (Score:2, Insightful)
Telling a newbie that they SHOULD do something right is way more impoortant than telling them the WRONG alternative.
There are many cases where machines are physically accessible by script kiddies, one would GO search for a unix-based PC just to "root" it after seeing this, I know many people who would.
I just don't think it's the right place to put such info.
Khalid
Re:Not a good idea ... (Score:2, Insightful)
I put this in the piece because I forgot my own password once, when I was first learning to use Linux. A buddy set up the machine for me, configured it, and I basically just played around on the command line. When I actually began to want to do things, I found I had forgotten my root password. Luckily, my buddy knew it, since he had set up the machine
My belief is that if we want to make Linux a viable alternative to Windows for garden variety users, we have to demystify it. This means giving them the tools to save themselves if they make mistakes.
We can't have it both ways. If we want people to use Linux, we can't keep them in the dark about the ins and outs. This means those of us who have boxes sitting around need to make sure they're physically secure. Both grub and lilo have password options...
Making a master key (Score:5, Insightful)
That would be really worthy of Slashdot.
The one thing that appears to be missing is the section "Why shouldn't I run as root all the time if I'm the only one using my system." In your house (comparing your single user system to your house) nobody can control you like a puppet. Somebody can't move your arms and legs and force you to take a sledgehammer to the hot water heater. If you are running Unix as root, any code that you run could make you do just that. It's worth protecting yourself against virii by not running as root.
Re:Making a master key (Score:2, Informative)
Re:Making a master key (Score:2)
Re:Making a master key (Score:2)
How does not running as root protect me from that?
Re:Making a master key (Score:2)
If you are a person that is reading about root and how to get it, you are probably the type of person that is willing to figure out what you should and shouldn't do to your system. If you have a bunch of users you trust, I'd think that would be a good argument for why you shouldn't give them root.
interesting analogy... (Score:2, Funny)
Um, yeah. Hey! NTFS has default journaling and no 15-minute filesystem checks!
Proudly serving Satan since ought-two.
Sudo (Score:4, Insightful)
When you use sudo, you will be asked for a password. But it's your own password, not the admin password. Also, you'll have to be configured with sudo access to run the command you're requesting. And your admin will be emailed if you try to do something you're not allowed to do.
root vs. Administrator (Score:4, Insightful)
Re:root vs. Administrator (Score:2)
An admin...to play a game!?
Re: Age of Mythology (Score:3, Informative)
I think you can do this (on XP) with the RUNAS command.. Something like:
runas
Throw that into a shortcut, enter the password once, and you're all set. Don't ask me where it's storing that password though.....
Re: Age of Mythology (Score:2)
Re: Age of Mythology (Score:3, Informative)
runas
The first time it would prompt you, but after that it would just load. You have to put that whole command line into a shortcut if you want to launch it from an icon or the start menu. You can nest quotes inside the command line with a backslash - I use this on a shortcut to launch the ISA administration console:
runas.exe
Backwards compatibility (Score:2)
Re:root vs. Administrator (Score:2, Interesting)
last thing I saw was no more file handles...
This is roughly as bad as having administrative privileges on Windows..
Re:root vs. Administrator (Score:2)
ulimit (in bourne shells) and limit (in C shells) can protect the machines from resource starvation attacks like these. In FreeBSD (and probably other BSD's as well, I've seen it in BSD/OS (a.k.a. BSDi) too) at least you can hardwire limits into the user's environment with the classes system and login.conf. Do equivalents for Linux exist?
What Microsoft did right... (Score:4, Insightful)
I am also having a hard time explaining to my wife why I have revoked most priviliges for the "Internet zone" in IE (yes, I prefer Phoenix too, but the sad fact is, that there are many sites that won't work unless you use IE) - somehow it is still to much of a bother to add sites that we trust to the "trusted site" list the first time we visit them.
Maybe you just need to get burned once to respect fire (and of course understand what happened). Within the first 48 hours of my job as a student programmer I managed to wipe all files of several projects - my current directory wasn't what I thought is was and I had become more priviliged than I should be. That day I learnt not to invoke all priviliges in the login-script but only as needed. I also learnt something about proper backup routines that day - the nightly backup really saved me (thank you dear sysadmin for saving my from the wrath of my colleges...!).
Oh - that reminds me of another story. As student programmers we were given group-privileges (this was VAX/VMS). It was very practical to be able to start and stop job on behalf of other student programmers etc. Once one of the other student programmers wrote a utility that would log you out every interactive session wherever you where logged in (which was rather handy when someone asked if you would like to come along for beer). The utility stopped all interactive processes that it could find, but the author remembered to explicitly turn of our group priviliges before doing so, so we didn't accidentially log each other out. Somehow our sysadmin got hold of this utility and since it was throughly tried and tested by us for several months, he trusted it. One crusual difference between a student programmer and a sysadmin is that a sysadmin has world-priviliges and the script didn't turn these of...! He learnt the hard way that as a sysadmin you should trust noone.
When we asked above mentioned sysadmin for more privileges ("can I have oper-privileges so I can restart this print-queue?!?") he always answered "Do you want more responsabilities?" No, we only wanted more privileges. "Well" he said "it is the same thing - do you still want your privileges?" Somehow it wasn't really nessecary with more privileges anyway. And that is perhaps one of the most useful lessons to be learnt.
Parent
MacOS is simpler than that (Score:3, Informative)
Re:MacOS is simpler than that (Score:2, Informative)
Not to spin off-topic or anything, but it's actually easier than that.. open a terminal with an administrative account and type "sudo passwd root" set root's passwd, then su up and party.
-matt
Re:MacOS is simpler than that (Score:2)
Kludge? (Score:4, Interesting)
What about capabilities, or mandatory access controls? Or some sort of framework that incorporates root privelages, instead of setting them aside as a special case. I've never been comfortable with the idea that the security system was only for "normal" users and didn't apply to a specific user called 'root' (or id 0), which, if compromised, you are entirely hosed.
Re:Kludge? (Score:2, Insightful)
What's a kludge is giving some random process complete superuser access, when all it needs to do is just one thing -- i.e., modify /etc/passwd, or bind to port 80, or access /dev/tape to do a backup. That's what MAC and capabilities are for.
Re:Kludge? (Score:3, Interesting)
When someone comes by and says that they need a new version of perl, or they would like you to install some lib that they need for some project, _that_ is when you break out the 'su -' and take off the kid gloves.
I've had a couple of people tell me that you only should need root access when something is seriously b0rken, it's not how you login to check your mail, logs, or grip the squid logs for porn.
As an extended metaphor, I drive my car (a user interaction) and can go under the hood to top off the fluids, change filters, etc. (sudo-ish stuff, simple interactions) by myself, but if I need to install new cams or take off the cylinder head, I leave that to my mechanic (root) who has the larger knowledge of what everything does and how to perform intricate tasks that are beyond day-to-day maintence and require complete control of the system.
I'm not going to say that there aren't risks with having a user account that bypasses the entire security model of a complex multi-user environment, but I think that on a machine which is run/maintained by a knowledgeable/responsible admin the functionality of 'root' in complex circumstances far outweighs the risk of having the account comprimised.
Re:Kludge? (Score:2)
Set your system-wide bash/login scripts to properly reference these paths, and not only do you no longer need to su for these problems, but you don't even need to sudo. Users can do this for themselves. Its a booteeful thing.
You can run unix machine for a long time with the root password in a vault, if you really lay things out correctly.
Re:Kludge? (Score:2)
The principles it violates are least privilege and separation of powers. Sudo helps take the curse off. So do features like the append-only file attribute -- even root can't erase a log that shows bad actions by root if the log file is append-only (have to boot to single-user to clear that flag).
Re:Kludge? (Score:2)
At some point, you have to have the `top' user who is able to grant all other users various priveliges, and to change all other users' passwords when they forget theirs. Call that user `root'.
Once you have that user, it's possible to write a program which, when run as that user, creates a new user with a known password or changes an existing users password to a known value, imbues them with whatever priveliges you _do_ want if it doesn't have them already, changes to _be_ that user(*) and then executes whatever code you actually want to execute.
However you cut it, you have to have a user with `top' control. If you pretend that that user doesn't exist, you will lull users into a false sense of security when they are running as that user.
If you make people aware that `root' can do anything, if you tell them to be scared of it, tell them to set up `sudo' and use it as much as possible because otherwise their system will get hosed, then they have a chance.
If you pretend otherwise, then that's just inviting disaster.
K.
(*) You could do this either by a `setuid'-type function, or setting up a program to execute on login and then arranging a login, or a whole bunch of other ways.
new slashdot motto (Score:2, Funny)
Next on up... (Score:5, Funny)
-Sean
You know what I want? (Score:4, Insightful)
I know everyone says "Switch to Linux! It's more powerful and stable then Windows, and it free!" But I have tried several times to switched, and everytime I do something goes wrong. I can't get the sound to work. I can't get my network card to work. I can't get the proper video drivers installed. I can't get it to boot up properly. Whatever. And everytime, I install Windows, spend an hour or two setting up my programs and getting everything, and I'm done. I'm using my system. I have never had that with Linux.
Basically, I want a Linux system that's as easy to install and use as Windows. I would love to learn how to use Linux properly. But I can't seem to learn it. And I've had to learn how to use an AS/400 system. Even that was easier to do then learn Linux. And I'm a programmer. It's not like I'm some dumb schmuck who thinks Windows is the best thing in the world. So until you can give me a Linux system that I can learn, or give me a better way to learn it...then you'll have problems getting the mainstream users.
Re:You know what I want? (Score:2, Insightful)
I want to use Linux. I want to use a command line. I want to know how to add and remove programs. I want to know how to add and remove hardware refences in the kernal. I want to know how to access my data. I want to know what programs are on my system, and what they do. I want to find programs that do specific tasks.
Sounds like you want to give Debian a try.
Also, Linux is not the only OS you can try. Try a *BSD or even OS X.
Re:You know what I want? (Score:2, Insightful)
From my experience, the only way to learn this stuff is to do it. Make mistakes. Buy a book or two, search the web for the stuff you don't understand, and make some really good hacker friends. Buy them caffeine.
Root has too many rights. (Score:2)
Really, root is one of the disadvantages of UNIX.
This article has been updated (Score:2, Informative)
Just wanted to let everybody know that the "Root 101" [iodynamics.com] article has been updated on the Iodynamics [iodynamics.com] site. Most of the revisions are based on the comments above.
I appreciate all of the great feedback, both here and via e-mail. This article has truly been a community effort.
--Dave