Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

To edit system files for example /etc/named/named.conf, I use:

su -
Password:
gedit

And then opens and edit above like files, instead of:

nano /etc/named/named.conf 

or:

vi /etc/named/named.conf

Can this habit of using GUI tools every now and again cause a security problem, especially in server environment?

share|improve this question
2  
if you downvote any Question please be good enough to give the specific reason. I respect your opinion but I think I have the right to know WHAT WENT WRONG. Thank you, Downvoters –  Nishan Aug 23 '13 at 12:35
    
This question may be useful to a lot of persons who have stuck with GUIs in deciding were they on right path or it is a time to turn over a new leaf –  Nishan Aug 23 '13 at 12:38
3  
The problem is not in a GUI tool, but the X environment. You have to have X server running to handle system calls and stuff. And that posses a possible security issue. I you really can't edit your files with a command editor, than it would be good to run X go to graphical desktop environment, run your precious gedit and then after you stop editing, you should also stop X server...sounds like a LOT of work for just editing a simple file. –  Alko Aug 23 '13 at 12:45
    
Anyway, you should know how to use a command-line editor in a server. Not always you will have X available. –  Renan Aug 23 '13 at 14:08
    
@Alko Your advice seems sounds. –  Nishan Aug 23 '13 at 14:15

3 Answers 3

Only in so far as the more code you have running, the more potential security holes there are. Thus at least in theory, you want to minimize the number and complexity of programs you have installed/running. In practice, as long as you stay on top of security updates, then no, there's no real security reason to avoid a gui on a server.

Of course, it does beg the question as to why you are even using the server on a graphical console rather than via ssh in the first place, where you should be quite comfortable using terminal editors.

share|improve this answer

If the only reason is edit a particular file I think switching to an interactive shell is already a "security issue". It's a point of view though.

Consider that you switch to root interactively. Then whatever you run, runs with highest privileges. Now, question is if you do trust applications you are running. Particular application can have a bug which poses a security issue.

My point is, that you want to minimize the stuff you run directly under the root. Running X application brings a complexity of whole X stack and if any backdoor or escape can be misused, attacker gains the root access. And it's not about the X stack only, it's about any software you run under the root. That's also reason why you / we have to be very careful about applications which has setuid bit set.

As a solution to your workflow I would offer the sudoedit command. You can use it in form of

$ sudoedit <file_to_edit>

It will try to authenticate / authorize you (as regular sudo does) and then it will run your preferred editor (set by EDITOR environment variable). Benefit over running as $ sudo $EDITOR <file_to_edit> is that the editor itself runs under your original privileges and after you exit it, it will replace the file with the results of your editing. Need to exit the editor to make changes effective might be a bit disruptive though.

share|improve this answer
    
My upvote for It will try to authenticate / authorize you (as regular sudo does) and then it will run your preferred editor (set by EDITOR environment variable). Benefit over running as $ sudo $EDITOR <file_to_edit> is that the editor itself runs under your original privileges and after you exit it, it will replace the file with the results of your editing. Need to exit the editor to make changes effective might be a bit disruptive though. –  Nishan Aug 23 '13 at 14:27

Don't worry about it. The main reason to get into the habit of text mode tools when you administrate servers is not security, but the ability to do things remotely on low-bandwidth or high-latency connections where GUI applications are impractical.

xkcd 1200

share|improve this answer
    
Thank you, for unburdening my security pressure. –  Nishan Aug 26 '13 at 6:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.