Root 101 - Concept of Root for Newbies 110
Fozz writes "One of my colleagues wrote this article explaining the concept of root/super user for Unix newbies. He wrote it after looking for information like it and not finding much. His analogy of Unix and an apartment complex is one of the best metaphors I've seen for understanding multi-user OSes." If you're running any variety of Unix, you've probably been forced to learn this pretty well already, but this is a very lucid explanation to point out to curious friends / co-workers who aren't so sure.
CLI (Score:2, Insightful)
ifconfig for example - I can rememeber the ifconfig line for any computer on my network and have it in and done in seconds
But in windows it takes a few minutes just to click click click
Re:CLI (Score:2, Informative)
Re:CLI (Score:1)
Different strokes
Re:CLI (Score:3, Insightful)
Sometimes the command line can save even more time, not just because you don't have to search poorly-layed-out GUIs for the option you want. For example, the other day I got really sick of having about 50 "incomplete" MP3s in my playlist. Rather than going through and deleting all the files one by one, I fired up Cygwin (which gives you a shell on Windows... quite handy!) and did "rm __INCOM*" to delete the countless files beginning with "__INCOMPLETE__" Nice and handy.
Not to mention the remote access aspect of the command line. I'm responsible for maintaining a webserver running Linux; it's so handy to be able to pull up an ssh session and do whatever needs to be done. Let's see the admins of the Windows boxes neighboring it work on their servers from home.
Anyway, I may have just bored everyone to death, but for those just getting into Linux/UNIX, don't fear the command line! If you take the time to learn it, you'll grow to love it.
Re:CLI (Score:2)
del ___INCOM*.* actually
Re:CLI (Score:1, Interesting)
One thing I do still use windows for, as I've not figured out how to do it easily in linux yet (anyone?) is if you need to rename part of lots of files... eg:
ren 10*.* 20*.*
or even
ren ??10*.* ??20*.*
Re:CLI (Score:2)
Many distros include a program called "rename" that takes a regular expression search-and-replace type expression and uses perl to rename files passed to it accordingly.
For example:
rename s/^10/20/ 10*
For example for your first example.
rename s/^(..)10/\120/
for the second.. and so on.
It does seem that some distros don't provide this program by default, and you might have to install it yourself tho. Even worse, there is a another rename program that doesn't work anything like this floating around.
Hope I've helped a bit...
Re:CLI (Score:1)
Cygwin is really nice though..
Re:CLI (Score:2)
Re:CLI (Score:1)
Well, yes. But what a big difference there is!
In DOS, a handful only of commands are available, without any easy way to find out what those commands are (think "tab completion" here), pipes are a childish toy in comparison to the way Unix shells work, there is no `backquote`, and the batch language is a minimalistic version of BASIC which can probably do a lot, but not as much as sh(1).
It's not about "the ability" to write scripts. It's all about the way those scripts can be written, the number of available tools that can be used in scripts, etc. etc.
--
Re:CLI (Score:2)
cmd.exe /? /?
cscript.exe
Re:CLI (Score:1)
The cd command works funny if you're changing drives, ie from A: to C:, and this whole concept of different "drives" is studpid.
Yikes, I'm offtopic!
Re:CLI (Score:4, Insightful)
Not to mention the remote access aspect of the command line. I'm responsible for maintaining a webserver running Linux; it's so handy to be able to pull up an ssh session and do whatever needs to be done. Let's see the admins of the Windows boxes neighboring it work on their servers from home.
---snip
It's not difficult to setup ssh on windows, and redirect the io of cmd.exe (or most any other CLI shell available for windows, come to think of it) through it if you know what you are doing. The problem isn't so much the OS, it's the type of admins the OS attracts. 90% of windows "admins" do not know how to use the cli and cli apps included with windows, or even use many of the graphical management tools included to their full extent.
With NT 5 native RDP support was added, although you have been able to make any NT machine support RDP for awhile now, (assuming you do not need multi-user support; in that case your stuck with their terminal server distribution, or purchasing something re-written by Citrix and dumping RDP for their protocol), and with NT 5 they made a telnet server an official part of the distribution (not that I would suggest using it). Of course, you could do all this years ago with NT 4 as well...(and with NT 3.5x with a little adaptation, probably).
BUT...do many NT "admins" know how to do this, or even have the slightest clue about where they would go to get started? Nope. And from what I have observed, in more than a few places having a _little_ more knowledge about the OS they "support" would have made their lives a lot easier...but they don't bother, they just keep slogging on with what little knowledge someone force fed them at a certification class.
Unix admins on the other hand tend to actually take an interest in knowing what makes their OS tick. Partly that the OS is much more open (for some Unix OS's, you can even get the source code easily). Partly that in the Windows world, the interface to a server appears identical to the interface to a workstation, which gives confidence to users who want to become an admin where they deserve no confidence at all
A good admin can make up for a weakness on any platform, whether it be Netware, Linux, Windows, or Lantastic, without needing to blame his/her tools. A lousy "admin" can also more than compensate for all the strengths of a platform. What matters most is the competency of the admins that tend to work with those systems, not really the systems themselves.
That all said, given a choice, I know which platform is takes me much less effort to secure than the others...heck, you might almost say it is "secure by default"
Re:CLI (Score:1)
Re:CLI (Score:2)
but in my experience, trying to manage windows from the command line is a horrendous task.
---snip
For sure, different OS's are more or less admin-friendly. But difficult is not the same thing as impossible.
Trying to manage windows from the CLI _is_ a much more difficult task than with most other OS's. However, with the right tools you can manipulate the registry database, kill or start a process, manipulate files, or just about anything else you would need to do. In any practical real-world situation you would not hassle yourself with trying to work that way, unless it were a task particularly suited to the command line (automation) or you were in a situation where a CLI was all you had available; remote admin of windows machine is almost always done in a GUI (although many of those GUI tools can be ran locally to manipulate a server remotely over a network).
A good admin _can_ accomplish all the same things, but too often people say "it cannot be done" out of ignorance rather than fact.
Woodworking is a hobby I am just starting out on. Ask me to make a particular type of joint with certain tools, and I will say it is impossible. Ask that of someone who has been working with wood his whole life and knows what he is doing, and he can make it happen. I said the tools were not capable of it, but in fact, it was me.
Re:CLI - Resource Kit = wonderful (Score:2, Informative)
A couple of links:
Hope this helps
Re:CLI - Resource Kit = wonderful (Score:2)
Re:CLI (Score:2, Funny)
You've obviously never managed a McDonalds.
--R
Re:CLI (Score:1)
Chris
misleading capabilites of root (Score:5, Informative)
Re:misleading capabilites of root (Score:1, Insightful)
Re:misleading capabilites of root (Score:1)
Re:misleading capabilites of root (Score:1)
Not a good idea ... (Score:5, Insightful)
Well, if someone needed it they'll know how to search and find out, but then, stating it right away in a "beginner" introduction only brings interest to script kiddies to *hack* the password. That's more of an eye opener than a warning.
Thanks for reading,
Khalid
Re:Not a good idea ... (Score:3, Interesting)
The reason it's in there in a newbie article is that newbies can have the habit of a short memory when it comes to passwords and the like. This I know from experience...
Re:Not a good idea ... (Score:2, Insightful)
Telling a newbie that they SHOULD do something right is way more impoortant than telling them the WRONG alternative.
There are many cases where machines are physically accessible by script kiddies, one would GO search for a unix-based PC just to "root" it after seeing this, I know many people who would.
I just don't think it's the right place to put such info.
Khalid
Re:Not a good idea ... (Score:2, Insightful)
I put this in the piece because I forgot my own password once, when I was first learning to use Linux. A buddy set up the machine for me, configured it, and I basically just played around on the command line. When I actually began to want to do things, I found I had forgotten my root password. Luckily, my buddy knew it, since he had set up the machine
My belief is that if we want to make Linux a viable alternative to Windows for garden variety users, we have to demystify it. This means giving them the tools to save themselves if they make mistakes.
We can't have it both ways. If we want people to use Linux, we can't keep them in the dark about the ins and outs. This means those of us who have boxes sitting around need to make sure they're physically secure. Both grub and lilo have password options...
Re:Not a good idea ... (Score:1)
To not print this information, on the grounds that it arms script kiddies a way in is only, *ahem* /stands up on soap box security through obscurity. Mind you, if you forget your openprom passwd on a Sparc, let it be known, it is possible to come back, but you've got a problem, so sending the message that it's very important to remember the passwords is a Good Thing.
Re:Not a good idea ... (Score:1, Insightful)
Re:Not a good idea ... (Score:1)
It would serve (for some poeple) as a -how to hack Hotmail through social engineering?- guide.
A real hacker would already know this and it is no problem with them, but a I-wanna-be-a-cool-hax0r script kiddie type would just find this a good tool for damage. Hiding it might not be right, but still it shouldn't be along side with an introduction.
I am against the place where it is mentioned, not against mentioning it as a whole (of course).
Re:Not a good idea ... (Score:1)
Making a master key (Score:5, Insightful)
That would be really worthy of Slashdot.
The one thing that appears to be missing is the section "Why shouldn't I run as root all the time if I'm the only one using my system." In your house (comparing your single user system to your house) nobody can control you like a puppet. Somebody can't move your arms and legs and force you to take a sledgehammer to the hot water heater. If you are running Unix as root, any code that you run could make you do just that. It's worth protecting yourself against virii by not running as root.
Re:Making a master key (Score:1)
Not only that, but in your own house you know better than to hit your water heater with a sledge hammer, unless you know what you are doing.
On computers, the people who this guide is written for do not know better, and as such, shouldn't do it
Re:Making a master key (Score:2)
If you are a person that is reading about root and how to get it, you are probably the type of person that is willing to figure out what you should and shouldn't do to your system. If you have a bunch of users you trust, I'd think that would be a good argument for why you shouldn't give them root.
Re:Making a master key (Score:2, Informative)
Re:Making a master key (Score:2)
Re:Making a master key (Score:2)
How does not running as root protect me from that?
interesting analogy... (Score:2, Funny)
Um, yeah. Hey! NTFS has default journaling and no 15-minute filesystem checks!
Proudly serving Satan since ought-two.
Sudo (Score:4, Insightful)
When you use sudo, you will be asked for a password. But it's your own password, not the admin password. Also, you'll have to be configured with sudo access to run the command you're requesting. And your admin will be emailed if you try to do something you're not allowed to do.
root vs. Administrator (Score:4, Insightful)
Re:root vs. Administrator (Score:2)
An admin...to play a game!?
Re: Age of Mythology (Score:1)
Re: Age of Mythology (Score:3, Informative)
I think you can do this (on XP) with the RUNAS command.. Something like:
runas
Throw that into a shortcut, enter the password once, and you're all set. Don't ask me where it's storing that password though.....
Re: Age of Mythology (Score:1)
Re: Age of Mythology (Score:2)
Re: Age of Mythology (Score:1)
Re: Age of Mythology (Score:3, Informative)
runas
The first time it would prompt you, but after that it would just load. You have to put that whole command line into a shortcut if you want to launch it from an icon or the start menu. You can nest quotes inside the command line with a backslash - I use this on a shortcut to launch the ISA administration console:
runas.exe
Re: (Score:1)
Re: Age of Mythology (Score:1)
It's not like blocking software isn't trivial to bypass even with a guest account.
Re: Age of Mythology (Score:1)
It's also "trivially" easy to boot from a CD and change the Administrator password. But only your dedicated hacker has such a CD. Security doesn't need to be air tight (which is good, as that is not possible), it only needs to be reasonable for the task at hand.
Re: Age of Mythology (Score:1)
Re: Age of Mythology (Score:1)
Re: Age of Mythology (Score:1)
And holy fucking shit, do the blockers block Google these days? I know they'd been restricting images/cache, but taking out the main google web search would just be crazy.
Backwards compatibility (Score:2)
Re:root vs. Administrator (Score:2, Interesting)
last thing I saw was no more file handles...
This is roughly as bad as having administrative privileges on Windows..
Re:root vs. Administrator (Score:2)
ulimit (in bourne shells) and limit (in C shells) can protect the machines from resource starvation attacks like these. In FreeBSD (and probably other BSD's as well, I've seen it in BSD/OS (a.k.a. BSDi) too) at least you can hardwire limits into the user's environment with the classes system and login.conf. Do equivalents for Linux exist?
What Microsoft did right... (Score:4, Insightful)
I am also having a hard time explaining to my wife why I have revoked most priviliges for the "Internet zone" in IE (yes, I prefer Phoenix too, but the sad fact is, that there are many sites that won't work unless you use IE) - somehow it is still to much of a bother to add sites that we trust to the "trusted site" list the first time we visit them.
Maybe you just need to get burned once to respect fire (and of course understand what happened). Within the first 48 hours of my job as a student programmer I managed to wipe all files of several projects - my current directory wasn't what I thought is was and I had become more priviliged than I should be. That day I learnt not to invoke all priviliges in the login-script but only as needed. I also learnt something about proper backup routines that day - the nightly backup really saved me (thank you dear sysadmin for saving my from the wrath of my colleges...!).
Oh - that reminds me of another story. As student programmers we were given group-privileges (this was VAX/VMS). It was very practical to be able to start and stop job on behalf of other student programmers etc. Once one of the other student programmers wrote a utility that would log you out every interactive session wherever you where logged in (which was rather handy when someone asked if you would like to come along for beer). The utility stopped all interactive processes that it could find, but the author remembered to explicitly turn of our group priviliges before doing so, so we didn't accidentially log each other out. Somehow our sysadmin got hold of this utility and since it was throughly tried and tested by us for several months, he trusted it. One crusual difference between a student programmer and a sysadmin is that a sysadmin has world-priviliges and the script didn't turn these of...! He learnt the hard way that as a sysadmin you should trust noone.
When we asked above mentioned sysadmin for more privileges ("can I have oper-privileges so I can restart this print-queue?!?") he always answered "Do you want more responsabilities?" No, we only wanted more privileges. "Well" he said "it is the same thing - do you still want your privileges?" Somehow it wasn't really nessecary with more privileges anyway. And that is perhaps one of the most useful lessons to be learnt.
Re:What Microsoft did right... (Score:1)
I'm going to bring the other flame magnet into the discussion here and present MacOS X as an example of a system that is very easy to use, but has a lot of functionality that can be unlocked if you want/need it. In fact, if I could afford a new toy right now, it would be a mac laptop of some flavor just 'cause I'm so enamored with BSD...er, OS X.
Unnecessary Admin Access - Next Jerry Springer! (Score:1)
It's a shame, but since most (home) users don't know the difference, they accept this, and run as a local admin.
MacOS is simpler than that (Score:3, Informative)
Re:MacOS is simpler than that (Score:2, Informative)
Not to spin off-topic or anything, but it's actually easier than that.. open a terminal with an administrative account and type "sudo passwd root" set root's passwd, then su up and party.
-matt
Re:MacOS is simpler than that (Score:2)
Kludge? (Score:4, Interesting)
What about capabilities, or mandatory access controls? Or some sort of framework that incorporates root privelages, instead of setting them aside as a special case. I've never been comfortable with the idea that the security system was only for "normal" users and didn't apply to a specific user called 'root' (or id 0), which, if compromised, you are entirely hosed.
Re:Kludge? (Score:2, Insightful)
What's a kludge is giving some random process complete superuser access, when all it needs to do is just one thing -- i.e., modify /etc/passwd, or bind to port 80, or access /dev/tape to do a backup. That's what MAC and capabilities are for.
Re:Kludge? (Score:3, Interesting)
When someone comes by and says that they need a new version of perl, or they would like you to install some lib that they need for some project, _that_ is when you break out the 'su -' and take off the kid gloves.
I've had a couple of people tell me that you only should need root access when something is seriously b0rken, it's not how you login to check your mail, logs, or grip the squid logs for porn.
As an extended metaphor, I drive my car (a user interaction) and can go under the hood to top off the fluids, change filters, etc. (sudo-ish stuff, simple interactions) by myself, but if I need to install new cams or take off the cylinder head, I leave that to my mechanic (root) who has the larger knowledge of what everything does and how to perform intricate tasks that are beyond day-to-day maintence and require complete control of the system.
I'm not going to say that there aren't risks with having a user account that bypasses the entire security model of a complex multi-user environment, but I think that on a machine which is run/maintained by a knowledgeable/responsible admin the functionality of 'root' in complex circumstances far outweighs the risk of having the account comprimised.
Re:Kludge? (Score:2)
Set your system-wide bash/login scripts to properly reference these paths, and not only do you no longer need to su for these problems, but you don't even need to sudo. Users can do this for themselves. Its a booteeful thing.
You can run unix machine for a long time with the root password in a vault, if you really lay things out correctly.
Re:Kludge? (Score:2)
The principles it violates are least privilege and separation of powers. Sudo helps take the curse off. So do features like the append-only file attribute -- even root can't erase a log that shows bad actions by root if the log file is append-only (have to boot to single-user to clear that flag).
Re:Kludge? (Score:2)
At some point, you have to have the `top' user who is able to grant all other users various priveliges, and to change all other users' passwords when they forget theirs. Call that user `root'.
Once you have that user, it's possible to write a program which, when run as that user, creates a new user with a known password or changes an existing users password to a known value, imbues them with whatever priveliges you _do_ want if it doesn't have them already, changes to _be_ that user(*) and then executes whatever code you actually want to execute.
However you cut it, you have to have a user with `top' control. If you pretend that that user doesn't exist, you will lull users into a false sense of security when they are running as that user.
If you make people aware that `root' can do anything, if you tell them to be scared of it, tell them to set up `sudo' and use it as much as possible because otherwise their system will get hosed, then they have a chance.
If you pretend otherwise, then that's just inviting disaster.
K.
(*) You could do this either by a `setuid'-type function, or setting up a program to execute on login and then arranging a login, or a whole bunch of other ways.
new slashdot motto (Score:2, Funny)
Next on up... (Score:5, Funny)
-Sean
Apartment Building analogy (Score:1)
-- R
Re:Apartment Building analogy (Score:1)
Hmmm. Didn't find that one in any of the research for this article. I actually wrote it because I couldn't find a really good online source that explained root for newbies.
I also like the metaphor another person here used to explain things. Anything that could be done from a driver's seat can be done under a user's login. If he wanted to change a battery or top off fluids, he would use sudo. If he needed to do major engine work, he'd log in as root.
Re:Apartment Building analogy (Score:1)
I agree that the apartment building analogy is a better one, and I found it odd that in 14 years,
I'd only ever seen it used twice by people other than myself (including you).
I can't quote it for you by verse, but it was alot to do with timesharing (IE: "everyone complains about slow service and exorbitant rents" is an exact quote), but he mentions that each tenant shouldn't be able to infringe on any of the others, and how one person could be doing one thing in thier space (writing email), and another in thiers (downloading recipies).
-- R
Re:Apartment Building analogy (Score:1)
There was another comment on this piece about an admin who had his root password on a PostIt taped to his monitor. (Of course, why the PostIt was taped when it should have been self-sticking is another topic for discussion. Maybe it had been there for a while and the sticky stuff had all worn of. Anyway...)
I like the way the analogy still holds up. The building superintendent taping the master key to his door. (Or leaving it on top of the mat.)
Re:Apartment Building analogy (Score:1)
Like the accounting server at my 2nd-last job.
It logged in automatically as LocalAdmin for PCAnywhere, but never locked the console. Ever.
The all-knowing Accpac server.
*shrugs and shudders*
-- R
You know what I want? (Score:4, Insightful)
I know everyone says "Switch to Linux! It's more powerful and stable then Windows, and it free!" But I have tried several times to switched, and everytime I do something goes wrong. I can't get the sound to work. I can't get my network card to work. I can't get the proper video drivers installed. I can't get it to boot up properly. Whatever. And everytime, I install Windows, spend an hour or two setting up my programs and getting everything, and I'm done. I'm using my system. I have never had that with Linux.
Basically, I want a Linux system that's as easy to install and use as Windows. I would love to learn how to use Linux properly. But I can't seem to learn it. And I've had to learn how to use an AS/400 system. Even that was easier to do then learn Linux. And I'm a programmer. It's not like I'm some dumb schmuck who thinks Windows is the best thing in the world. So until you can give me a Linux system that I can learn, or give me a better way to learn it...then you'll have problems getting the mainstream users.
Re:You know what I want? (Score:2, Insightful)
I want to use Linux. I want to use a command line. I want to know how to add and remove programs. I want to know how to add and remove hardware refences in the kernal. I want to know how to access my data. I want to know what programs are on my system, and what they do. I want to find programs that do specific tasks.
Sounds like you want to give Debian a try.
Also, Linux is not the only OS you can try. Try a *BSD or even OS X.
Re:You know what I want? (Score:2, Insightful)
From my experience, the only way to learn this stuff is to do it. Make mistakes. Buy a book or two, search the web for the stuff you don't understand, and make some really good hacker friends. Buy them caffeine.
Re:You know what I want? (Score:1)
Re:You know what I want? (Score:1)
It's the hardware (Score:1)
Linux supports most hardware, but I've been burned before so I always check before I buy. The most likely problem if you buy new is hardware that isn't yet supported in Linux. The WinModem was the most aggravating of these. At the time I accidentally got one of those, I didn't know such things existed (and Linux didn't support them at the time-- too new) so I didn't know to check. The manufacturers made it hard to tell a WinModem from a real one without opening the box.
The way hardware is added to the PC is horrible. Plug and Play helps, but is really a bandaid. How is the hardware identified? Configured? Allocated resources to avoid conflicts? Used? There is still no standard way of handling these issues outside of Windows.
Most manufacturers provide a Windows driver (which is usually buggy-- never use the driver that came on the included CD, first check their web site for updates) but Linux is left in the cold. Consequently for new hardware there can be a delay of months before dedicated Linux driver hackers finally manage to wangle the necessary details from the manufacturer or reverse engineer the Windows driver or something. Manufacturers tend to fear intellectual property theft too much to be very cooperative.
Don't be too hard on Linux-- sure, Linux needs improving, but problems aren't always Linux's fault. Didn't Bill Gates once complain he was tired of Windows (in the days of version 3.1) getting blamed when some poorly written device driver caused a problem? That was a big motivation behind Microsoft's efforts to take over the work of providing drivers. Remember the bad old days of DOS when each graphics application had its own stable of video and printer drivers and configuration issues?
Re:Resetting the root password (Score:1)
If you have physcial access and no password has been set on the bios or bootprompt from modifing the command it is easy to bypass anything. (BIOS because why should the machine boot from anything but the hard drive once it is setup?).
Root is a God! (Score:1)
Root has too many rights. (Score:2)
Really, root is one of the disadvantages of UNIX.
Rebooting single won't do it (Score:1)
If I ever loose my root password, my only way to recover it is to use an emergency boot disk, booting the kernel with a ramdisk whose image is on another disk, with no root password, mount the / on my harddrive to
That's why I keep boot disks for each of my systems, and update them whenever I change my kernels due to new hardware, or simply because I upgrade to a more recent Linux version.
Re:Rebooting single won't do it (Score:1)
Easy.
This article has been updated (Score:2, Informative)
Just wanted to let everybody know that the "Root 101" [iodynamics.com] article has been updated on the Iodynamics [iodynamics.com] site. Most of the revisions are based on the comments above.
I appreciate all of the great feedback, both here and via e-mail. This article has truly been a community effort.
--Dave