Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any issue to put / as a home directory of root user from security point of view instead of /root

share|improve this question

2 Answers 2

Yes. /root has 700 permission (rwx------) whereas / has 555 (r-xr-xr-x) permissions for all users.

Now if you use various common utilities you would have /root/.config with rwxr-xr-x permissions. If you were in /, that directory becomes accessible to anyone on the server, whereas if it was in /root it would not be.

Having root's data accessible to any user is a security risk.

Edit 1

Note that /root/.config is an example, there are many other folders, folders as diverse as any one of hundreds of thousands of possible programs that root can run.

Yes, technically it is security by obscurity. But for example, would you send me the IP address of your server please? Why not? Why do people obscure IP addresses and server names etc in posts?

For the exact same reason you don't want unauthorised people accessing root's data. The same reason you don't hand out a network map. If roots data is not secure, you must vet every single program to ensure it secures it's data properly instead of just knowing it's safe because it's in /root.

Morpheus: We've survived by hiding from them, by running from them. But they are the gatekeepers. They are guarding all the doors, they are holding all the keys. Which means that sooner or later, someone is going to have to fight them.

In the case of root, root is the gatekeeper, guarding all the doors, holding all the keys. That's why root is a big fat target for everyone trying to hack a server.

Edit 2

In warfare you never give your enemy anything. He is not to know when your patrols are scheduled, when your convoys are due to arrive, where your potatoes come from, what time breakfast is served, what time the guards are changed, where your main powerline runs, which tent or barracks belongs to the commander, who the commanders driver is, what jeep does he drive, anything.

In counter intelligence we want the enemy to know nothing about us at all, because through the long history of the world we can find many many examples of how what has been thought to be the most trivial piece of information has been used to bring down kingdoms, destroy nations, assassinate kings and win battles.

So ask yourself this question. Which is more secure?

  • Knowing something about root
  • Knowing nothing about root

The choice of whether or not to restrict access to any information about root, roots activity or roots data should be trivially obvious. No professional answer can be otherwise.

share|improve this answer
    
I find this amusing that reading root's config is a security issue. Now reading root's mail on the other hand ... –  Joshua Aug 20 at 16:16
    
@Joshua the more you know about root's configuration, the better you know potential attack points in the programs which use this configuration. –  Ruslan Aug 20 at 16:58
1  
I'm used to the files being limited to .vimrc, .exrc, .profile and .history (where I explicitly mark .history as 600). .bash_history I link to .history. Anybody who uses root for much more is probably making a worse mistake. –  Joshua Aug 20 at 17:05
    
We hide our IP addresses, at least for the server, because the user doesn't want/need to know them. Anyone who wants to know can find out the IP address of pretty much any server, and that's not even servers your computer connects to directly. –  trysis Aug 20 at 17:35
    
Traditional unix systems have no /root. Plenty of Linux systems out there have /root publicly readable (it's the default on some distributions). It's very very common for /root to hold nothing of interest. –  Gilles Aug 20 at 20:14

It is my understanding there are severe problems if you ever log in to X as root with root's home directory set to /. In the old days the protection provided by /root was considered unnecessary and having root's home dir as / was merely untidy but not so much anymore. root didn't used to have full sessions but now he does if some people misuse the system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.