Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If a user with administrative privilege can have all the powers of root using sudo , then what is the advantage of having root account?

share|improve this question
1  
A typical usage is system maintenance possibly when you need a system recovery. For instance, when you select the "recovery mode" to boot from the Grub menu. –  Barun Aug 27 '13 at 7:04
1  
Isn't not having to use sudo an advantage? Note that having "all the powers of root" is not quite the same as being root, since the root user can take those powers away, but no one can take them from root. –  goldilocks Aug 27 '13 at 8:26
    
Thank you everybody for help! Barun, goldlocks, slm, and Joseph R. Marking it as solved. –  Aaditya Bagga Aug 27 '13 at 17:27

2 Answers 2

up vote 2 down vote accepted

Disabling root

You have to have a root account. The only things you can do with it, in terms of "disabling" it, are:

  1. Lock the account

    $ sudo passwd -l root
    
  2. Give root an unusable password

    $ sudo usermod -p '!' root
    

sudo - as user root

Remember that when a user with "administrative privileges" is making use of sudo they're running commands with elevated privileges as the user root!

You can see that this is true with a simple ps command:

$ sudo sh -c "ps -eaf | grep [s]udo"
root      2625 26757  0 04:19 pts/10   00:00:00 sudo sh -c ps -eaf | grep [s]udo

The above shows that when the ps command is executed, you're effectively the user root.

Booting

Also when booting into a system in single user mode (from GRUB), you'll need to login using the root account. Typically you're passing either the word single to GRUB or the number 1.

What sudo permissions do I have?

On a system where one has been given sudo permissions you can use the command sudo -l to see what rights you do have. These are not a complete set of everyone's rights, just the user that's running the command.

For example:

$ sudo -l
Matching Defaults entries for saml on this host:
    env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG
    LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME
    LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User saml may run the following commands on this host:
    (ALL) ALL
    (root) NOPASSWD: /usr/lib/jupiter/scripts/bluetooth, (root) /usr/lib/jupiter/scripts/cpu-control, (root)
    /usr/lib/jupiter/scripts/resolutions, (root) /usr/lib/jupiter/scripts/rotate, (root) /usr/lib/jupiter/scripts/touchpad, (root)
    /usr/lib/jupiter/scripts/vga-out, (root) /usr/lib/jupiter/scripts/wifi

NOTE: The commands one's been granted access to are everything after the line, "User saml may run the following ....".

Limiting access via sudo

Sudo has a fairly rich facility for limiting access to specific commands, groups of commands, specific users, and/or specific groups of users. There are some caveats however with sudo.

You can grant full access to everything with this line in /etc/sudoers:

aaditya      ALL=(ALL)    ALL

You could also give a user what appears to be simple access to vim certain files:

aaditya      ALL=/usr/bin/vim

This would be a huge mistake however, since many editors such as vim allow you to invoke a subshell from within them. So the user aaditya would be able to gain access to a shell with root permissions, even if the sudo permissions didn't intend for that to happen.

share|improve this answer
    
At college I am using RHEL v5, and I have a sudo account (added myself to /etc/sudoers), but I cant run administrative commands like adduser( sudo adduser - gives output adduser: command not found). But when the system admin logins as root , he can perform the adduser command. So if using sudo gives me same privileges as root, why cant I perform the adduser command? –  Aaditya Bagga Aug 27 '13 at 14:43
    
@AadityaBagga - it's not giving you the same permissions as root, it's giving access to run certain commands AS root! If you're able to add yourself to /etc/sudoers, then you're likely able to do whatever you want. Adding a line such as this to /etc/sudoers: aaditya ALL=(ALL) ALL will grant you carte blanche access to do anything AS root. –  slm Aug 27 '13 at 14:59
    
I added myself to /etc/sudoers by requesting the sysadmin to let me access the root account using su. I thought that if I added myself to sudoers I could perform administrative commands but I cant! –  Aaditya Bagga Aug 27 '13 at 15:16
    
@AadityaBagga - if you have su access to root then you can do anything you want through that as well. A sudo -l is still the best way to see what your account has been granted, officially. There are always cracks 8-). –  slm Aug 27 '13 at 15:25
    
@slm..I dont have access to su! I requested the sysadmin to open a terminal with su so that I could add myself to the sudoers list in order to perform administrative commands, but I am not able to, as I have mentioned earlier. So perhaps there is a difference between the root account and an administrator added to /etc/sudoers. –  Aaditya Bagga Aug 27 '13 at 15:34

An administrative account and root are by no means the same. Other than what goldilocks and slm mentioned you should also know that root can significantly limit what the sudo user is allowed to do on root's behalf (see man sudoers for examples). This is especially useful when a senior sysadmin wants to delegate some administration tasks to a junior admin without granting them full access. After all, a user with full sudo access can hijack the root account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.