1

I have some questions about Linux security:

  • Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user (I just used chmod, chown to have access to special files and to be able to run them). Is that a better, than running a process/daemon/program as root?

  • What if I use sudo su and then start a process, is it equal to the security of running process as user? Or instead is it the same as running a process as root?

  • Should I install software as root? Or maybe as a regular user?
  • What about editing configuration files, should I do it as root or maybe, as I did before, with sudo su from my regular unprivileged user account?

migrated from serverfault.com Oct 16 '15 at 13:09

This question came from our site for system and network administrators.

0

The general idea is for a process to ask for (and have) the least amount of privilege it needs to do its job. Examples of this are web servers that bind to port 80 (which might need root) but then change to a non-privileged system user afterwards.

You may have noticed "might need root" not, "must have root". Traditionally, processes would have to start as root to bind to a port less than 1024 and would then change later. Now with capabilities if set up correctly you don't need to do this. CAP_NET_BIND_SERVICE will let you bind to a port less than 1024 not as root.

This is another iteration of "doing the same with less". Why run as root with ALL the access that gives when you only need one aspect which is binding ports. Capabilities give you this granularity.

The difference between starting the daemon as root or as a different user and sudo as root is minor and generally will give the same results.

For editing, admin work etc most people prefer being a "standard" user and sudo for those tasks. Making it impossible to login as root closes one possible insecure door.

Software generally is installed as root. Why? Because if your webserver can modify its binaries or config files (why yes apache, I think your publically accessible directory should be /etc) is a bad idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.