4

I am trying to understand what is a conceptual difference between unix root account and windows local admin. I am a developer and despite IT department efforts were always given local admin rights so I could install whatever I want on my local PC.

But for some reason (and I think it should be a good one) I am just a user in our linux system. That makes it is impossible to me to sudo things - e.g. to get software installed from repositories, etc.

I suppose it is because root permissions grant much more privileges than local admin rights on windows. Is that the case?

Also is it possible in unix to grant particular user rights to install software e.g. using apt-get or yum?

Improve this question

2 Answers 2

Reset to default
5

I suppose it is because root permissions grant much more privileges than local admin rights on windows. Is that the case?

That is not the case (at least not in principle), but one major difference is in how the user (account) is identified. A local admin account on Windows has its own SID (security identifier) distinct from any other account, and thus can easily be differentiated from any other local admin account (on the same or on a different computer), while all root accounts share the same numerical user ID and thus cannot easily be told apart.

Depending on the setup, this can be a major obstacle for giving users even "local" root access. One potentially serious issue I can think of off the top of my head is NFS user IDs.

Also is it possible in unix to grant particular user rights to install software e.g. using apt-get or yum?

You can set up sudo to allow such things, but it'd probably be a gaping security hole. What if you make and install a package that amends the sudo configuration, installs a setuid root shell, or anything else along those lines? Suddenly, your supposed "restricted" root access has granted the user full root access to the system. Even "mundane" things like sudo editors for editing particular configuration files must be carefully implemented to avoid introducing similar serious security vulnerabilities.

Improve this answer
3
  • +1 Of course in the particular case of NFS UID's you can (must?) use the root_squash option or the all_squash option if you're extra paranoid.
    – Joseph R.
    Oct 11, 2013 at 12:02
  • 1
    @JosephR. Of course, but that was only an example. I would be surprised if it's the only issue.
    – user
    Oct 11, 2013 at 12:23
  • Agreed of course. Hey, lots of of courses there :)
    – Joseph R.
    Oct 11, 2013 at 12:23
3

I don't know much about Windows' administration, but I don't think there's much difference between Windows' admin and Linux' root. (I may be misunderstanding something, but from your question I infer everyone in your company has a Windows normal PC or fat client, and a Linux thin client or simple user SSH access)

It is normal practice not to give root access on thin clients (since it's company-wide root access) while letting users administrate their own PCs isn't a problem.

You can't install sofware with the package manager (apt-get/yum/...) since it requires root access. You may either request your sysop to install the needed packages, or install them locally in your home directory (which you have write access to, thus not requiring root).

For installing in your home directory, you can use the following procedure (I'll use a real life example with Screenfetch, adapt it to your needs) :

  • create a specific folder for the software you install in user space: mkdir ~/local
  • go in that folder: cd ~/local
  • download the sofware you want to install: wget http://git.silverirc.com/cgit.cgi/screenfetch.git/snapshot/screenfetch-3.2.0.tar.gz
  • extract the archive: tar -zxf screenfetch-3.2.0.tar.gz
  • read the README to check the specific tasks that may be needed to build/run the software
  • make the binary executable: chmod +x screenfetch-3.2.0/screenfetch-dev
  • add a shortcut or an alias to launch your software (may change a lot depending on your distribution, shell and desktop environment) In my example, I want to launch screenfetch from command-line on my work desktop (Linux Mint 13 with Bash) so I'll add the following line to my ~/.bashrc file: alias screenfetch='~/local/screenfetch-3.2.0/screenfetch-dev'
Improve this answer
2
  • No, we have both Windows PCs and Linux PCs (not just a thin client - but the actual box) and while we do have local admin account on Windows PC we are not given local root access on Linux PCs. This is why I wonder - perhaps there is no such thing as a local root, and the root can only be global, e.g. like a Active Directory admin on Windows. What do you mean install them locally, I assume one can only install things locally, how can I do that without root access?
    – Mitten
    Oct 11, 2013 at 9:42
  • @Mitten: edited my answer to help you install software. Locally was a literally-translated word, which was already inaccurate in French. If I'm not mistaken, the correct way to name it is installing in user-space. Unfortunately, I don't have any experience with company-wide IT management, so I can't call if there is indeed an Active Directory equivalent managing your company's Linux computers. (if there's no such limitation, your sysop's practice are inconsistent, but I guess there's not much to do about it)
    – François Lecomte
    Oct 11, 2013 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .