Tag Info

Hot answers tagged

52

If you take a look at the executable sudo: $ which sudo /usr/bin/sudo $ ls -la /usr/bin/sudo ---s--x--x 2 root root 208808 Jun 3 2011 /usr/bin/sudo You'll notice that it carries the permission bits ---s--x--x. These can be broken down as follows: -|--s|--x|--x - - first dash denotes if a directory or a file ("d" = dir, "-" = file) --s - only ...


42

In the page Top Ten One-Liners from CommandLineFu Explained is suggested this trick (the #3): :w !sudo tee % this write the current buffer to the stdin of the command after the !. The % symbol is substituted with the current filename.


36

Yes, root can: $ echo Hello you\! > file $ chmod 600 file $ ls -l file -rw------- 1 terdon terdon 11 Feb 27 02:14 file $ sudo -i # cat file Hello you! In any case, even if root couldn't read your files as root, they can always log in as you without a password: $ whoami terdon $ sudo -i [sudo] password for terdon: # whoami root # su - terdon $ whoami ...


33

Saving space for important root processes (and possible rescue actions) is one reason. But there's another. Ext3 is pretty good at avoiding filesystem fragmentation, but once you get above about 95% full, that behavior falls off the cliff, and suddenly filesystem performance becomes a mess. So leaving 5% reserved gives you a buffer against this. Ext4 ...


29

For the same reasons why each daemon should have minimal rights. Apache can run as root. It is designed to perform one task and surely nothing bad can happen? But assume apache is not bug-free. Bugs are discovered from time to time. Sometimes it can even be arbitrary code execution or similar. Now with apache running as root, it can access anything — for ...


25

The commands in a script execute one by one, independently. The Script itself as the parent of all commands in the script, is another independent process and the su command does not and can not change it to root: the su command creates a new process with root privileges. After that su command completes, the parent process, still running as the same user, ...


25

Why root over SSH is bad There are a lot of bots out there which try to log in to your computer over SSH. These bots work the following way. They execute something like ssh root@$IP and then they try standard passwords like "root" or "password123". They do this as long as they can, until they found the right password. On a world wide accessible server you ...


23

You can also ride a motorcycle in the nude, and nothing may happen. But I bet you'd feel better if you had when you crash the bike...


22

sudo cannot change the effective user of an existing process, it always creates a new process that has the elevated privileges and the original shell is unaffected. This is a fundamental of UNIX design. I most often just save the file to /tmp as a workaround. If you really want to save it directly you might try using a feature of Vim where it can pipe a file ...


22

The hardware power button triggers an ACPI event that acpid (the ACPI daemon) notices and reacts to; in this case by shutting down the system, although you could have it do whatever you want. The ACPI daemon runs as root, so it has permission to shutdown the system. Desktop environments (e.g. gdm for Gnome) typically run as root as well, so I suspect they ...


20

Ah, use the passwd program as root: sudo passwd root Or, if you’re running as root already (which you shouldn’t be), just: passwd The root argument can be omitted, because when you execute passwd it defaults to the current user (which is root, as only root can change the root password).


20

In short, because the execute bit is considered special; if it's not set at all, then the file is considered to be not an executable and thus can't be executed. However, if even ONE of the execute bits is set, root can and will execute it. Observe: caleburn: ~/ >cat hello.sh #!/bin/sh echo "Hello!" caleburn: ~/ >chmod 000 hello.sh caleburn: ~/ ...


20

No, sudo cannot be considered universal. sudo is installed by default on Red Hat Enterprise Linux and its derivatives,1 but it only installs ready-to-use in RHEL 7 and newer. Red Hat Enterprise Linux 7 added a new option to the installation screen where you create the first non-root user, a checkbox labeled "Make this user administrator." Its purpose is ...


19

If you allow others to log on to your system, via ssh, for example, having these 5% blocks reserved ensures external users cannot fill the disk. Even if you don't allow others to log in to your system, the reserved blocks prevents programs not running as root from filling your disk.


19

The original home directory of the root user was the root of the filesystem / (http://minnie.tuhs.org/cgi-bin/utree.pl?file=V5/etc/passwd). I think the user was indeed named after that directory. But why 'root' and not 'start' or 'origin' or something else? Well, before Ken Thompson and Dennis Ritchie wrote UNIX, they were (also at Bell Labs) developing ...


19

There are two questions there: Difference between su - username and su username If - (or -l) is specified, su simulates a real login. The environment is cleared except for a few select variables (TERM notably, DISPLAY and XAUTHORITY on some systems). Otherwise the environment is left as it is except for PATH that is reset. Difference between passing no ...


19

Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses. The system administrator can define email aliases in the file ...


18

Binary packages are compiled with the assumption that they will be installed to specific locations in /. This is not always easily changed, and it would take additional QA effort (which is difficult enough in the first place!) to determine whether specific binaries are or aren't relocatable. To an extent, you can use things like fakechroot to create an ...


18

By default, no, that's not allowed. Under Linux (from man 2 kill): The only signals that can be sent to process ID 1, the init process, are those for which init has explicitly installed signal handlers. This is done to assure the system is not brought down accidentally. Pid 1 (init) can decide to allow itself to be killed, in which case the ...


17

'root' is traditionally the name given to the user account with superuser level rights. In this respect they are one and the same, though there is no rule that I know of that says that the superuser account must be called root. It may be that the account was named 'root' due in part to the fact that only the superuser has write permission to the root ...


16

Saving the file as root: :w !sudo tee %


16

Suppose you're exchanging data with a computer on a port <1024, and you know that computer is running some variant of unix. Then you know that the service running on that port is approved by the system administrator: it's running as root, or at least had to be started as root. On the wide, wild world of the Internet, this doesn't matter. Most servers are ...


16

This command does nothing, at least on the OS I use (Solaris) with which this security feature was first implemented: # rm -rf / rm of / is not allowed On other *nix, especially the Linux family, if a recent enough Gnu rm is provided, you would need to add the --no-preserve-root option to enable the command to complete (or at least start). How far would ...


16

Always assume that root (and any other user/process with CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH) can do everything unless an LSM (SELinux, AppArmor or similar) prevents him from doing that. That means also that you should assume that all your keystrokes can be read. Passwords aren't really safe. If you want a serious level of security then you must use a ...


15

Use su: su - alice sudo vim /etc/hosts From man su: The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. For more ...


14

Theoretically, changing it in /etc/passwd and /etc/shadow would be all you need to 'rename' root. The problem occurs because pretty much every single piece of Unix software in existence assumes that the username 'root' exists and that it is the superuser -- mail aliases, various daemons, cron... If you're really hell bent on trying it, find /etc -type f ...


14

Check the permissions of the directory. To delete a file inside it, it should be writable by you chmod ugo+w . and not immutable or append-only: chattr -i -a . Check with ls -la and lsattr -a.


13

According to Linux Info, the origin of the name may have come from file system layout / permissions: The use of the term root for the all-powerful administrative user may have arisen from the fact that root is the only account having write permissions (i.e., permission to modify files) in the root directory. The root directory, in turn, takes its name ...


13

For basic operation — running commands as root — the most visible difference between sudo and su is that sudo requires the user's password and su requires root's password. The security implications have been discussed extensively in a previous question: Which is the safest way to get root privileges: sudo, su or login?. Sudo has additional features beyond ...



Only top voted, non community-wiki answers of a minimum length are eligible