RootSudo

[oneleaf]

Sudo and the Root Account

In Ubuntu, the traditional UNIX 'root' account is disabled (i.e. it is not possible to log in as root). The reasons for this choice are outlined later in this document.
Quick Answers

To execute commands with root privileges, the command 'sudo' is used in front of each command, e.g.

sudo chown bob *

You will be prompted for your password, which will be stored for 15 minutes. After that time, you will need to enter your password again.

While using Ubuntu you are encouraged to use sudo.

To start a root shell (i.e. a command window where you can run root commands) use:

sudo -s

Warning: sudo -s doesn't change the environment variables ($HOME, $PATH etc). It can have some bad side effects. You can use sudo -i to initialize a full root environment.

To enable the root account (i.e. set a password) use:

sudo passwd root

To disable the root account after you have enabled it use:

sudo passwd -l root

This locks the root account.

To give a graphical application root privileges use either:

gksudo [application]

or

:

kdesu [application]

The kdesu in ubuntu has been patches to use sudo.

Using sudo as opposed to gksudo/kdesu can sometimes lead to file ownership problems.
Benefits of this model

The benefits of leaving root disabled by default include the following.

*

Initially the Ubuntu team wanted the easiest install possible. By not enabling root, a couple of steps requiring user interaction during install could be avoided. (Colin Watson)
*

Even more significantly, if root were enabled during install, the user would be required to forever remember the password they chose--even though they would rarely use it. Root passwords are often forgotten by users who are new to the Unix security model. (Matt Zimmerman)
*

It avoids the "I can do anything" interactive login by default--you will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing. If you were logged in as root, you could just delete some of those "useless folders" and not realize you were in the wrong directory until it's too late. It's been good Unix practice for a long time to "su-command-^D" regularly instead of staying in a root shell--unless you're doing serious system maintenance (at which point you can still "sudo su"). (Jim Cheetham and Andrew Sobala)
*

Sudo adds a log entry of the command(s) run (In /var/log/auth.log). If you mess up, you can always go back and see what commands were run. (Andrew Zbikowski)

Security

While there are various advantages and disadvantages to this approach, compared with the traditional superuser model, neither is clearly superior overall.

*

By encouraging the execution of single commands with root privileges, rather than opening a shell, sudo:
o

Reduces the amount of time spent with root privileges, and thus the risk of inadvertently executing a command as root
o

Provides a more useful audit trail
*

Having a separate root password (the traditional model) provides an extra layer of protection if an administrative user's password is compromised
*

In either case, if the administrative user (who uses sudo or su to become root) is compromised, the attacker can generally gain root through an indirect attack

Possible issues with the "sudo" model

Although for desktops the benefits of using sudo are great there are possible issues which need to be noted.

*

Some packages from universe are effectively broken (e.g. webmin) or become dangerous to use. A good workaround is to enable the root account before dealing with the affected packages (sudo su-; passwd <password>) and to lock it again afterwards (su -; passwd -l).
*

Redirecting the output of commands run with sudo can catch new users out (consider "sudo ls > /root/somefile"). Workarounds for this include using "sudo sh -c 'ls > /root/somefile'" (but escaping for this gets very ugly very quickly), using Adverbio, or simply using sudo -s to get a root shell and going from there
o

MattZimmerman: A simple approach which works for most cases is to use dd(1): ls | sudo dd of=/root/somefile
*

In a lot of office environments the ONLY local user on a system is root. All other users are imported using NSS techniques such as nss-ldap. To setup a workstation, or fix it, in the case of a network failure where nss-ldap is broken, root is required. This tends to leave the system unusable unless cracked.
o

JerryHaltom: Perhaps in these cases it neccassitates the creation of a local account: "admin" with sudo to root privledges.
o

LucasVignoliReis?: I think this is a good idea, a sudoer system administration account, and normal user accounts for the other users.

Misconceptions

*

Isn't sudo less secure than su?
o

The basic security model is the same, and therefore these two systems share their primary weaknesses. Any user who uses su or sudo must be considered to be a privileged user. If that user's account is compromised by an attacker, the attacker can also gain root privileges the next time the user does so. The user account is the weak link in this chain, and so must be protected with the same care as root. On a more esoteric level, sudo provides some features which encourage different work habits, which can positively impact the security of the system. sudo is commonly used to execute only a single command, while su is generally used to open a shell and execute multiple commands. The sudo approach reduces the likelihood of a root shell being left open indefinitely, and encourages the user to minimize their use of root privileges.
*

I won't be able to enter single-user mode!
o

The sulogin program in Ubuntu is patched to handle the default case of a locked root password.

[oneleaf]

Sudo 和 Root 帐号

在 Ubuntu, 传统 UNIX 'root' 被屏蔽了 (也就是 你不能使用 root 来登录). 这样选择的原因在本文的后面做出描述.
快速回答

使用 root 权限执行命令, 在每个命令前面加上 'sudo' 命令, 例如

sudo chown bob *

你将会提示输入你的口令, 口令将保存 15 分钟. 过了这个时间, 你将需要重新输入你的口令.

在使用 Ubuntu 时，推荐使用 sudo.

启动一个 root shell (例如 一个你可以运行 root 命令的窗口) 使用:

sudo -s

警告: sudo -s 不会改变环境变量 ($HOME, $PATH 等). 它有一些不好的副作用. 你可以使用 sudo -i 初始化整个 root 环境.

为了启用 root 帐号 (也就是 设置一个口令) 使用:

sudo passwd root

当你使用完毕后屏蔽 root 帐号 使用:

sudo passwd -l root

这个将锁住 root 帐号.

给 图形界面的应用程序 root 权限，使用以下两者中的任何一个:

gksudo [application]

或:

kdesu [application]

ubuntu 中的 kdesu 已经修改成使用 sudo.

使用 sudo 与 gksudo/kdesu 相反, 有可能产生文件的所有权问题 .
这种模式的好处

缺省禁止 root 的好处包括了以下内容.

*

起初 Ubuntu 团队希望安装尽可能的简单. 不使用 root , 在安装期间的两个用户交互步骤可以省略. (科林·沃森)
*

更进一步, 如果在安装中使用 root, 用户将被要求永远记住他们选择的密码--即使他们很少使用到它. Root 密码经常被对 Unix 安全模型不熟悉的用户忘记. (马特·齐默曼)
*

它防止了缺省登录时 "我能做任何事情" --在较大的变化发生之前，你将被提示输入口令,这可以使你考虑你这样做的结果. 如果你作为 root 登录, 你可以删除一些 "没用的文件夹" 并且不会意识到你正处于错误的目录，那时已经太晚了. 它是在 Unix 下长时间使用 "su-command-^D" 练习的情况下，代替一直呆在 root shell--除非你做严重的系统维护 (那时你仍然可以使用 "sudo su"). (吉姆·奇塔姆 和 安德鲁·索巴拉)
*

Sudo 增加了运行命令的日志记录 (在 /var/log/auth.log). 如果你陷入困境, 你总是可以返回并看见那些运行的命令. (安德鲁·Zbikowski)

安全

与传统的 superuser 模型相比，这种方法有不同的利弊，两者都不总是显示优良的.

* 在鼓励使用 root 权限执行一个单独的命令, sudo 好过打开一个 shell:

* 减少使用 root 权限的时间总耗用, 降低了不注意使用 root 执行命令的风险

* 提供了有用的审核痕迹

* 有一个单独的 root 密码 (传统模型) 提供了一层额外的保护，当如果一个管理员的密码被侵害时。

* 无论怎样, 如果管理员 (使用 sudo 或 su 变成 root) 被侵害, 攻击者一般可以通过一次间接的攻击来获得 root

使用 "sudo" 模式可能的问题

尽管桌面使用 sudo 的是有利的，不过还是有些可能的问题需要注意.

*

一些来自 universe 的包将有力的破除 (例如 webmin) 或让使用变得危险. 一个好的变通方法是在处理收影响的包之前激活 root 帐号 (sudo su-; passwd <password>) 并在后面锁住 (su -; passwd -l).
*

运行使用 sudo 的命令重定向输出可能引发新用户问题 (考虑 "sudo ls > /root/somefile"). 变通方法是使用 "sudo sh -c 'ls > /root/somefile'" (但这种替换变得非常丑陋), 使用 Adverbio, 或简单的使用 sudo -s 获得 root shell ，在那里执行。
o

MattZimmerman: 对于大多数的简单解决方法是使用 dd(1): ls | sudo dd of=/root/somefile
*

在许多办公室环境系统上唯一的用户就是 root. 全部其他用户使用 NSS 技巧例如 nss-ldap 导入. 安装一个工作站, 或修复它, 在这个案例网络失败，导致 nss-ldap 被断开, root 被要求使用. 这中倾向于留下系统无法使用，除非被破解.
o

JerryHaltom: 也许在那些案例必需建立一个本地帐号: "admin" 拥有 sudo 到 root 权限.
o

LucasVignoliReis: 我认为这是一个好的主意, 一个 sudoer 系统管理员帐号, 和一个普通帐号给其它的用户.

误解

*

sudo 没有 su 安全?
o

基本的安全模型都是一样的, 因此这两个系统有着一致的主要弱点. 任何使用 su 或 sudo 必需是一个特权用户.如果攻击者损害了那个用户的帐号, 下次用户这样做时，攻击者同样可以获得 root 特权. 用户在这条链上是一个弱的连接, 因此必须作为 root 用户小心保护. 在更深的层次, sudo 提供不同的工作技巧, 这些肯定可以影响到系统的安全. sudo 通常被用来只执行单一的命令, 当 su 被通常使用打开一个 shell 并执行多条命令. sudo 尽量减少一个离开时被打开 root shell 的可能性, 并鼓励减少用户的 root 特权.
*

我不能进入单用户模式!
o

在 Ubuntu 的 sulogin 程序被计划修改来处理被锁住的 root 口令.

[oneleaf]

http://www.ubuntu.org.cn/docs/UserDocum ... ument_view

[millenniumdark]

这个肯定已经搬到wiki的某个地方了