14

I've set up my sudoers so that it asks the root password instead of the user password everytime I use sudo. Mainly because I believe it makes sense that if you want to execute a root command, you should know the root password.

However, could this be considered a security risk?

And if is not, why isn't this the default configuration in most distros?

Edit: I am running a personal Linux Machine, where I am the only user. Does the rational make more sense in this context? I do think that this may not apply to multi-user systems.

Context: My experience with sudo was on systems where sudo was simply a "synonym" for su. One could run any root command by simply typing their user password, which I thought defeated the purpose of root to begin with. Hence my reasoning to have it ask you for the root password. Having said that I was unaware of the power of sudoers, some users mentioned that you could specify which commands can be run with sudo (while leaving out some commands restricted to the root user only). This I think is a great middle ground

6
  • 1
    Anyhow, even after giving your context, your question remains a good and valid question: For a single user system with a well-configured sudoers, you can choose to ask for the root password instead of the user password. Unfortunally, most answers talk about giving away the root password or logging in as root instead of using sudo (both of with is outside the question's scope). But there is an advantage in your rational, as mentioned in my answer.
    – Philippos
    Jul 1 at 7:18
  • 1
    "One could run any root command by simply typing their user password, which I thought defeated the purpose of root to begin with." - It's worth noting that the privilege to do so is normally controlled via group membership, so that only trusted users can do this. So consider "adding someone to the sudo group" as equivalent to "telling them the root password". It isn't (or shouldn't be) the case that just anyone can sudo.
    – marcelm
    Jul 1 at 13:30
  • It's best practice not to have sudo (or su) at all. Jul 3 at 4:06
  • If you want to use the root password to run privileged commands, you don't really need sudo. Jul 3 at 11:29
  • If you stepped back a few paces and designed your ideal security set-up, where and how would Root and Sudo come into it? Jul 3 at 18:49

7 Answers 7

32

Some would consider this a security risk because it undermines two of the main purposes of using sudo rather than su, which are:

  1. sudo makes it easy to allow users to run some, but not all, commands as root, and

  2. You don't have to give out the root password. Having the root password is potentially far more dangerous than just being allowed to run certain commands as root.

Once someone has the root password, they can either login as root or use it with su. It is also harder to revoke root access from just one person - you have to change the root password and let everyone know what the new password is. With sudo's default configuration, you only have to change the sudoers file and/or remove the user from the sudo group.

This is why it's not the default configuration for sudo.

I strongly recommend that you revert back to the default behaviour as it is almost certainly more well thought out than your belief that it "makes sense" that you should have to know the root password. "common sense" is usually neither "common" nor "sensible".

sudo was written, at least in part, to avoid the problems caused when everyone who needed some ability to do some root-level sysadmin tasks had to know the root password. In practice, this proved to be extremely problematic, especially in large environments like universities or corporations where people changed roles a lot.

I've worked in several environments over the years where people had moved on to other roles in the same organisations years before (or even left the organisation completely) but still had root access on machines that they shouldn't even still have a valid login on. There's also the issue that people often get upset when you do the actually right thing and remove root access and/or disable accounts when those things are no longer needed.

14
  • 5
    "Having the root password is potentially far more dangerous than just being allowed to run certain commands as root." -- why?? The default configuration in e.g. Ubuntu is to allow running anything via sudo, even sudo bash, sudo -s, or sudo chmod u+s /bin/sh. That's... not much different from just logging in with the root password, well after it's been set to begin with.
    – ilkkachu
    Jun 30 at 12:48
  • 7
    1. that's why i said "potentially" rather than "certainly". 2. not everyone configures sudo to be open-slather. some put in the effort to customise sudoers to their exact needs, regardless of what the default settings are on whatever distro they might be using.
    – cas
    Jun 30 at 12:51
  • 2
    err yes, and I was asking about that potentiality. And yes, of course you can change the sudo configuration, or remove it, or install it into a system that doesn't have, or use something else entirely. But the question did ask about the rationale for the "default configuration in most distros". (And the defaults are rather relevant anyway, IMO, exactly because they're widespread.)
    – ilkkachu
    Jun 30 at 12:55
  • 5
    Also, if users are used to sudo for everything (even if it’s open-bar), at least their commands are logged (until they discover sudo -s etc.). Jun 30 at 13:01
  • 2
    @Philippos i don't think they're asking about multi-user environments. they don't describe their environment at all, so i make no assumptions. BTW, it's not at all uncommon for distros aimed at single-user desktops to not even have a root password. Several distros don't even to ask you to set one, they just set up root with a disabled password and you have to set it yourself if you want one (personally, i think that's bad practice but for some weird reason they didn't consult me about it).
    – cas
    Jun 30 at 13:40
23

Consider a hypothetical (but very plausible) scenario: a user who has the root password mistakenly changes the password for root, and does not record it.

You now have a situation where no one has the root password, and thus no one can elevate to root. This effectively breaks sudo via root password for everyone, requiring remedial actions (with downtime) to reset the password.

3
  • 27
    The converse also applies: everyone using sudo knows the root password; if one user should no longer have access, the root password needs to be changed and everyone else informed of the change. Jun 30 at 12:46
  • @StephenKitt yes, good point. being able to easily revoke root access from some users is important. gonna steal that point :)
    – cas
    Jun 30 at 12:48
  • This situation is basically the same as in a default Ubuntu install: there's only one user that can log in as root (actual su root is disabled by default, the normal user is a sudoer), and if its password is changed, no one can elevate to root.
    – Ruslan
    Jun 30 at 22:39
6

The sudoers mechanism has many advantages compared to giving out the root password:

  • Allowing to run a restricted set of commands as an admin

  • Accountability, as commands run via sudo can be logged so to know who ran what

  • Easy transfer of admin rights, simply by adding and removing users from the admin group

Giving all users the root password defeats completely the use of sudoers, since users won't need to use sudo: they'll login simply as root.


Edit after the OP's added:

Edit: I am running a personal Linux Machine, where I am the only user. Does the rational make more sense in this context? I do think that this may not apply to multi-user systems.

Effectively, if you are the only user on the system, the above doesn't apply and you can login as root instead of running sudo any time you need to operate as an admin. Be careful though that your action will have more impact, and it will be easier for you to damage the system. To quote an ancient UNIX Zen master:

"Only through root can true pain – and thus enlightenment – be achieved."

3
  • Anyhow the question was not about using sudo vs. working as root, but which password to use for sudo, so I don't see how this answers the question at all.
    – Philippos
    Jul 1 at 6:55
  • The password for sudo must be the user password. Using the root password to do sudo doesn't make any sense.
    – dr_
    Jul 1 at 7:25
  • Of course it makes sense to have a different password as sudo password: Someone who steals your password will not have sudo rights at the same time.
    – Philippos
    Jul 1 at 8:30
4

I tried to look at what the Ubuntu docs say about that.

The Ubuntu Server Guide mentions under User Management that

Ubuntu developers made a conscientious decision to disable the >administrative root account by default in all Ubuntu installations.

and

Instead, users are encouraged to make use of a tool by the name of ‘sudo’ to carry out system administrative duties. [... ]This simple yet effective methodology provides accountability for all user actions, and gives the administrator granular control over which actions a user can perform with said privileges.

And go on with instructions on how to enable the root account, by setting a password for it.

The Community Help Wiki at help.ubuntu.com, page RootSudo (archived), mentions ease of use, new users and not logging in as root all the time at first:

Please keep in mind, a substantial number of Ubuntu users are new to Linux. There is a learning curve associated with any OS and many new users try to take shortcuts by enabling the root account, logging in as root, and changing ownership of system files.

Both documents at best gloss over the option of having sudo ask a distinct password, but the wiki page has a list of upsides and downsides of the current system, and it at least gives an indication of what they might have thought.

The first two advantages listed are that the installer has fewer questions to ask, and that the user only needs to remember one password. Both are arguments for ease of use. The third listed one is an argument against logging in as root and for the extra step of sudo, namely in that it might make the user stop to think more about what they're doing:

  1. It avoids the "I can do anything" interactive login by default. You will be prompted for a password before major changes can happen, which should make you think about the consequences of what you are doing.

They also mention what @bxm said in their answer, that having a single root password (with or without sudo) would make it harder to deauthorize users, and the fact that sudo logs what it runs and can theoretically be configured to be more limited than allowing everything.

I say "theoretically", since e.g. setting rules to stop sudo from starting a shell are bound to fail against a determined abuser, as they can e.g. install a distinctly named shell (countering any blacklists), or just install a setuid shell binary (bypassing the need for sudo to start with). Both can be done with just cp and chmod.

Given that properly setting up whitelists for sudo isn't that simple, and the fact that there seems to be little instruction on how to do it, I'm guessing the part about ease of use, chance of forgetting a more seldom-used root password, and having each password used by just one person are the main reasons.

(Note that it's technically possible to have distinct root/sudo passwords for each user, in addition to their normal user account passwords. At least one way to do that is to create multiple UID 0 accounts, set the targetpw option in sudoers, and then have the users sudo to their own root account instead of root. E.g. the regular user john could have a corresponding root user john_root, and when they needed, they'd run sudo -u john_root whatever command it was. Of course you could do the same with just su instead of sudo. The downside of this is that for reasons I've never understood, some people seem to vehemently oppose having multiple named accounts with the same UID.)

3
  • You clearly don't like sudo. Jun 30 at 15:55
  • @QuartzCristal, why would you think so? I listed the points that the Ubuntu docs mentioned, and pointed out that some of the things mentioned there are not actually as simple as saying "you could do this" makes it sound like. The problem of trying to make things safe by blacklisting isn't inherent to sudo, but to the way how a vast array of tools can be used to bypass the blacklist, if you get to run any of those as root. Whitelisting works much better but it's hard to be a system administrator in general if you can't run cp or chmod.
    – ilkkachu
    Jun 30 at 16:20
  • @QuartzCristal, other than the difficulty of whitelisting, I don't think I was too opinionated on the other points they made in the docs. Ease of use is something I understand at least Ubuntu aims at, and it's not a bad goal. But of course, someone else may have other goals, ones that come at the expense of ease of use. There are things I actually don't like, like the way processes inherit numerous settings from their parents, which makes it hard to create a clean environment for a process started with changed privileges, though e.g. sudo. (Assuming you don't want to give all-open access.)
    – ilkkachu
    Jun 30 at 16:31
3

Your question suggest that you are the only user on that system (I've set up my sudoers … everytime I use sudo), while the given answers are viewing it mainly from the multi-user point of view.

The reason for the default configuration is the original idea for sudo: To give restricted superuser access to certain users.

In today's Linux distributions the idea is probably more like yours: Easy access to restricted areas of your system with a small »please beware« reminder.

To use the root password in this scenario has one main advantage (if a root password is set at all):

If sudo rights are properly configured, knowing your password only harms your account, not the whole system (potentially including your backup. You need a second key to enter the machine room.

3

Is having root password for sudo considered a best practice?

no

those user's who should have root permissions or elevated permissions are placed in the wheel group. Then only those users can su to root or rather use sudo. Using su requires typing the root password, which is the bad practice and what you want to avoid. Using sudo specifically sudo -i is a very nice way to get a root prompt which doesn't require typing the root password, the user types their password and it only works if they are in the wheel group.

in /etc/sudoers there is

  • sudo -i requires the given user to type their password, and not the root
## Allows people in group wheel to run all commands
%wheel  ALL=(ALL)       ALL

That is the default configuration, at least in RHEL/CentOS 7.x; it is a happy medium. First the user has to be in the wheel group to use su or sudo. I'm not sure how to properly prevent a wheel group person from using su but even using sudo -i they can still change the root password and cause problems. So it is in /etc/sudoers with using visudo that you would want to reconfigure and undo the ## Allows people in group wheel to run all commands %wheel ALL=(ALL) ALL. For a home linux system this is all overkill, but a work environment with legal implications and all that is when it becomes significant.

It was mentioned I've worked in several environments over the years where people had moved on to other roles in the same organisations years before (or even left the organisation completely) but still had root access on machines that they shouldn't and even still have a valid login on. That is not the fault of su or them having known the root password, that's a problem of existing adminsand management not doing proper housekeeping and changing the root password and deleting/expiring the employee's login.

The obvious pitfall is any wheel group admin can change the root password and cause havoc. To prevent that edit that line in /etc/sudoers to %wheel ALL=(ALL) ALL, !/usr/bin/passwd root. And also %wheel ALL=(ALL) ALL, !/bin/su root. I would say this and simple use of the wheel group is a best practice first step. Then edit /etc/sudoers to restrict administrative roles and use more admin groups other than wheel to accomplish a reasonable security for who should and should not be able to do what.

3
  • blacklisting passwd root is a nice idea, but I think passwd defaults to changing the current user's password so just running passwd when you're root would change root's password. (Though I'm not sure if it checks the user ID, or e.g. $USER in the environment, it might matter.) Running su under sudo is a bit useless, and trying to blacklist all shells is a bit of a whack-a-mole, and a pain for the cases where the admin has a legitimate need for a shell. (e.g. modifying files in a directory that's not readable under your usual account is a pain, because tab-completion doesn't work..)
    – ilkkachu
    Jun 30 at 14:47
  • redhat has a few kb articles on that whole thing, stuff I don't want to deal with, wish they would just standardize on an acceptable bulletproof security/admin strategy not allow numerous ways to configure such a thing... where there's always a loophole.
    – ron
    Jun 30 at 18:27
  • 1
    kinda like security doors- we're gonna install this steel door with multiple deadbolts to protect you but... i can just pick up a brick laying right there and go through this window right next to the door to get in. :facepalm:
    – ron
    Jun 30 at 18:29
1

However, could this be considered a security risk?

Yes. It is always a bad idea to hand out roots password.

I would add my own $0.01 (inflation has taken its toll)... I use sudo, without asking for a root password. However, I do set a root password. In other words, when using sudo, you use your own password. If, however, you were at a console and logged in as root, it would not be passwordless and not let you login. It has a password set. A lot of new users do not setup roots actual password and exclusively use sudo. This is fine, until you are dropped to a command prompt during a filesystem issue upon boot (for example), and you need to type roots password for maintenance.

Just a thought.

1
  • 1
    No handing out of the root password is involved in the question.
    – Philippos
    Jul 1 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.