Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've been using Linux for a while now and whenever I typed sudo I thought I was switching over to the root user for a command.

Apparently this is not true because all I need is my user account's password. I'm guessing since I haven't worked with multiple users I haven't really noticed this in the real world.

I am unsure how Ubuntu sets up my first account. Is there a root user? Am I root? I'm guessing I just created a new user upon installation but it gave me root privileges? Just a little confused here...

So why am I allowed to run root commands with my user's password?

share|improve this question
    
Using which user you need the password and in which you don't? What command you are running? Remember, that sudo stores your password for a time before you have to retype it. –  Braiam Aug 18 at 1:58
9  
sudo has the "setuid" bit set. So it runs as the user who owns it (which is root on all standard systems if I'm not mistaken), not the user who launches it. sudo then loads the /etc/sudoers file and checks what is allowed based upon who launched it. –  ultrasawblade Aug 18 at 14:38
3  
    
"Am I root?" There really is a difference: Type whoami, then sudo su, then whoamiagain (and finally exit) –  Hagen von Eitzen Aug 19 at 13:08
    
I’m sorry if I’m repeating something somebody else said, but I couldn’t find it. The answer is: It’s a policy decision. My best guess at the motivation is that, in a large installation where you have many people with sudo privilege, maybe working at geographically distributed locations and on 24×7 shifts, you want to be able to revoke one person’s privileged access immediately (e.g., if you suspect his integrity). If everybody is using the one-and-only root password, and you change that without prior coordination, chaos may result. … –  G-Man Aug 19 at 22:21

5 Answers 5

In details it works the following way:

  1. /usr/bin/sudo executable file has setuid bit set, so even when executed by another user, it runs with the file owner's user id (root in that case).

  2. sudo checks in /etc/sudoers file what privileges do you have and whether you are permitted to run the command you are invoking. Saying simply, /etc/sudoers is a file which defines which users can run which commands using sudo mechanism.

    That's how that file look on my Ubuntu:

    # User privilege specification
    root    ALL=(ALL:ALL) ALL
    
    # Members of the admin group may gain root privileges
    %admin ALL=(ALL) ALL
    
    # Allow members of group sudo to execute any command
    %sudo   ALL=(ALL:ALL) ALL
    

    The third line is what presumably interests you. It lets anybody in the "sudo" group to execute any command as any user.

    When Ubuntu sets up the first account during installation it add that account to the "sudo" group. You can check which groups which users belong to with group command.

  3. sudo asks you for a password. Regarding the fact that it needs user's password, not the root's one, that is an excerpt from sudoers manual:

    Authentication and logging

    The sudoers security policy requires that most users authenticate themselves before they can use sudo. A password is not required if the invoking user is root, if the target user is the same as the invoking user, or if the policy has disabled authentication for the user or command. Unlike su(1), when sudoers requires authentication, it validates the invoking user's credentials, not the target user's (or root's) credentials. This can be changed via the rootpw, targetpw and runaspw flags, described later.

    However, in fact, sudo does not need your user password for anything. It ask for it just to ensure that you are really you and to provide you some kind of warning (or chance to stop) before invoking some potentially dangerous command. If you want to turn off password asking, change the sudoers entry to:

    %sudo   ALL=(ALL:ALL) NOPASSWD: ALL
    
  4. After authentication sudo spawns child process which run the invoked command. The child inherits the root user id from its parent -- the sudo process.


So, answering your questions precisely:

I thought I was switching over to the root user for a command.

You were right. Each command preceded with sudo runs with the root user id.

Is there a root user?

Yes, there is a root user account, separate from your user account created during system installation. However, by default in Ubuntu you are not allowed to login to interactive terminal as root user.

Am I root?

No, you are not a root. You only have privilege to run individual commands as a root, using the sudo mechanism described above.

So why am I allowed to run root commands with my user's password?

You have to enter user's password only due to sudo internal security mechanism. It can be easily turned off. You gain your root powers because of setuid bit of /usr/bin/sudo, not because of any passwords you enter.

share|improve this answer
6  
The answer should really start with the setuid part, because that's the reason that it is actually possible. /etc/sudoers is just the reason for the flexibility of the sudo command. –  daniel kullmann Aug 18 at 18:35
    
Interesting. I didn't know that you could specify that sudo could be run without inputting my password. Great answer! –  jwir3 Aug 18 at 19:37
    
Note that sudo can be configured to ask for the root password with the rootpw flag in sudoers. –  Martin Schröder Aug 19 at 19:46
    
You can in fact login as the root user: sudo su - root will do just that and give you a root terminal. However you cannot easily login to a desktop session as root. –  jmiserez Aug 19 at 20:59
    
Basically sudo has root privilege by itself, and it decides whether to impart that to you based on a configuration file. –  Siyuan Ren Aug 20 at 9:38
  • The whole point of sudo is to grant you someone's else privileges (usually root) without asking for this other account's password (unlike su).

  • sudo is asking here for your password just to make sure a passerby won't misuse your unlocked terminal.

  • Ubuntu and many other Linux and Unix OSes are granting an initial account created at installation time the right to run any commands as root.

  • While root is still an account under Linux, direct root logins are disabled by default for a better security and traceability.

share|improve this answer
7  
Although direct root login is indeed disabled by default, there is still a root account with Ubuntu. It is no more an account on at least Solaris where it is by default a role. –  jlliagre Aug 18 at 14:36
    
Thanks a lot - I always wondered how that worked anyway, and it now makes a lot more sense. –  mikeserv Aug 18 at 18:56

The answer to your question is:

When you run a command with sudo, you run the command with elevated priviliges, that is root priviliges. You only have to type your normal user password because you (the user) has been added to sudoers file which gives you root priviliges.

share|improve this answer
2  
Except sudo doesn't imply elevated privileges, just different ones to the current user. E.g. you could run a program as a normal user who doesn't have a shell. Also, being in the sudoers file doesn't give root. –  aragilar Aug 19 at 1:10

First, disabling an account is usually done by setting the encrypted password to *, which is not the encrypted value of any string. I can't check right now, but I believe that's what Ubuntu does for root as well. So technically, there is no root password on Ubuntu.

But sudo precedes Ubuntu; it was designed for systems where there certainly were root passwords. So why doesn't it require the root password? Basically, sudo is designed to give permission to run specific commands to certain users --- e.g., allow a developer root access to re-start the web application, but not to start arbitrary servers. Knowing the root password, on the other hand, gives you unlimited access; you can use login or su to open a root shell and run arbitrary commands. Since sudo has to work for people without that level of access, it can't require the root password to run.

share|improve this answer
    
It also allows one to revoke a user's root privileges without having to change the root password. –  Ian D. Scott Aug 19 at 17:53

Piotr gave a very good explanation of how sudo works. However, he didn't really motivate why it works this way, so I'll try to add that here.

Before the sudo command was created, we had the su command. This command allows one user to execute commands as another user, usually root (as with sudo, this is the default target user). It was totally undiscriminating, you can execute any command. Since it could be used by any user, was effectively equivalent to logging in as that user, it required you to know the target user's password.

At some point, a little more access control was added: to use su, you had to be a member of the wheel group. But since you still could execute any command, it still made sense to require you to know their password.

Requiring users to know each other's, or the superuser's, password was not very secure, though. Often you just want to give certain users limited access to some other account (this is part of a security concept called the principle of least privilege). It also makes accountability difficult: if multiple people know an account's password, and that account is involved in a mistake or abuse, you can't tell which of them actually did it.

So sudo was created. Rather than allowing users to execute any command, it has an elaborate configuration file, briefly touched on in Piotr's answer, that specifies precisely who may use it, what users they can switch to, and what commands they're allowed to run. With this fine-grained control over who can do what to whom, we no longer need to give users the target account's password; if we did, they could easily bypass all the controls in the configuration file by logging in as that user. Instead, we normally just require them to prove that they are who they logged in as, by entering their own password -- this is intended to prevent someone from taking advantage of an account if the terminal is left unattended.

This requirement is waived for the superuser -- this account can do almost anything to the system without using sudo, so it was deemed superfluous. It's also possible to specify in the configuration file that users don't have to enter a password at all -- some organizations use this when they believe the physical security of their workstation environment is sufficient to prevent abuse.

share|improve this answer
    
I haven't explored this, but I understand one of the features of sudo that su does not have is that it (is able to?) keep a log of what commands were run by which user to make it easier to trace problems back to their sources. I just looked on my kubuntu system and do not see such a log, so maybe this is not a default behavior. –  Joe Aug 24 at 17:32
    
Just found sudo logging in /var/log/auth.log - along with a lot of other stuff including some IPs from China trying to get root ssh access to my system - so, if you just want to see sudo, you have to filter it through grep or similar. –  Joe Aug 24 at 18:17
    
Correct. su also logs, but since it just starts a new shell, it just logs the fact that someone ran it. –  Barmar Aug 25 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.