0

Unix & Linux shell/CLI is very flexible which gives lots of powers and privileges to its root user but it also comes with a great responsibility of executing commands correctly.

I have seen lots of people went in trouble by executing wrong commands accidentally and lost data and configured servers as it doesn't show any warning while executing the commands, the internet is full of with such cases.

So my question here is how we can be on root privilege and also very safe while using CLI?

closed as too broad by Jeff Schaller, Christopher, Romeo Ninov, GAD3R, Kiwy Apr 24 '18 at 20:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    IMHO, you can't. Just read the command line before pressing Enter. – Kusalananda Apr 24 '18 at 13:08
  • @Kusalananda, yeah that's there but, Human is to err. few people will end up due to less knowledge and sometimes they will do it in hurry – Ali786 Apr 24 '18 at 13:12
  • The root account does not receive any warning for its actions. By definition, it can do anything and it should do so. This "no warning" situation also occurs to normal users: for example, when they run rm file. Many Linux distributions provide sudo, so that you must think about an operation, before performing it, and you must confirm it with your password. This gives you a temporary almost root privilege, to be renewed each time: this is an attempt to make you more safe in CLI in those systems. – BowPark Apr 24 '18 at 13:14
  • implement a nazi selinux policy that avoid any root modification. – Kiwy Apr 24 '18 at 13:16
  • @BowPark Except that it's temporary actual root privilege sudo gives (after all it runs the command to be executed as root so by definition it's with root priveleges). – skyking Apr 24 '18 at 13:54
7

One popular way to remind yourself you're running in privileged mode is to set up your shell prompt to show your username as red. Most prompts will change to a # when running as root, but it's helpful to also see a "dangerous" color to know you should use caution.

Another idea is to use the principal of least privilege as much as possible. Use a tool like sudo to restrict your user's ability to run only a subset of commands (in a normal mode). This is also a cornerstone of the selinux patch which implements mandatory access control (MAC) on system resources. Some find selinux to be prohibitively difficult to work with, but if you learn it well, it's a very useful tool.

As others have said, there's really no way to be perfectly safe while running as root, so it's best to have regular backups and some procedure in place should the worst happen. We all make mistakes, but if you're able to recover from them, the mistakes don't cost you that much.

It may be a little too broad for your application, but check out GitLab's postmortem of their database corruption incident last year. Specifically, here are some steps they took to set up their PS1 to indicate the "safety" of their environment.

Not the answer you're looking for? Browse other questions tagged or ask your own question.