Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

All Questions

Tagged with
-3
votes
1answer
34 views

Scientific Linux 7x - Too much system hardening!

Some Linux users like my company build Linux servers to use on factory production lines. We write software to load BIOS and FLASH memory and test our products. We constantly need to reboot these ...
1
vote
2answers
99 views

Is it possible to hide an area of hard disk from root user?

Do linux kernel have a feature that can be used to hide an area of hard disk (e.g last 1GB of hard disk) from root user or at least make that area completely unwritable by any means?
0
votes
1answer
80 views

Is there a way to prevent root user from modifing kernel and boot loader?

Suppose that a regular linux machine is compromised by an attacker who obtained a root shell, he can modify the system kernel or modify boot loader to load another kernel. Is there a way to prevent ...
0
votes
1answer
63 views

How to add a new user and disable its root login? [closed]

A sysadmin may want to add a new user that will have no root access (nor sudo). I don't sell hosting services but I can bring this field as an example; an hosting company gives its customers the ...
3
votes
3answers
70 views

Sudo tickets and subsequent non-sudo sibling process

Imagine that locally on my system sudo is configured with a timeout, so that once I authenticate after running sudo once in some terminal, I don't need to re-authenticate for another 10 minutes. Does ...
2
votes
1answer
328 views

How to prevent root login from GNOME 3 login screen (Arch Linux)?

I am running an up-to-date installation of Arch Linux and GNOME 3.28. For security reasons I don't allow root login in the consoles. I have done this by configuring /etc/securetty. However, it ...
0
votes
2answers
128 views

Big security problem in Nautilus 3.28.1

In my Arch Linux installation with Gnome 3.28, I recently noticed that I can enter with Nautilus in the private directory /root and see the files inside while Nautilus is started without root rights. ...
4
votes
3answers
1k views

Should I always set the root shell to /usr/bin/false?

To prevent abuse of the root account (on my macOS, single user) machine, should I always set the root shell to /usr/bin/false (or /sbin/nologin)? For example should I always: sudo /usr/bin/dscl . -...
-1
votes
2answers
60 views

Is this account of root privileges in UNIX correct?

Some university lecture notes claim that In Unix systems, it is written into the operating system that some functionalities can only be accessed by the root user: modifying passwords, accessing to ...
1
vote
1answer
303 views

How to restrict some commands for admin in Linux(CentOS)

how to restrict some commands for admin in Linux(CentOS) I tried to use visudo in root , and write ABC ALL=ALL,!/bin/rm,!/bin/sudo to restrict the "ABC" user not to remove some important files. ...
0
votes
2answers
122 views

Is there a reliable way to make several user accounts behave as root, except sudo?

I and a friend are administrating a fair number of virtual machines, each one dedicated to some task in the overall system. When we need to administrate them, we typically log in as root, since the ...
2
votes
2answers
209 views

Are there any gotchas with granting a user root privileges by making them UID=0 GID=0?

I and a friend are administrating a number of virtual machines, each one dedicated to some task in the overall system. When we need to administrate them, we typically log in as root, since the only ...
3
votes
1answer
6k views

Should I disable the root account on my Debian PC for security? [closed]

From a security standpoint should I disable the root account for my personal computer running Debian 9.1? And if so: what would be the best way to do this?
0
votes
4answers
586 views

From a security standpoint should I add my user to the sudoers file or not? [closed]

I'm wondering what's best practice from a security standpoint: should I add my user to the /etc/sudoers file on my single-user computer or rather just leave %sudo in there? Would this cause any ...
1
vote
1answer
319 views

Disable Root Password Login… but can I SUDO with a GUI SFTP program? [duplicate]

I fully understand why I should disable Root login on a production server. That makes sense. I can log in as username, then sudo back to root functions just fine from the terminal. What I'm ...
1
vote
0answers
125 views

Prefer sudo over su by using a separate user with full sudo “privileges”?

Can I combine the security of su (which is in my view, and broadly speaking: not everybody can be root) and the convenience of sudo (password timeout) if I: create a user "admin" (for example) give ...
1
vote
1answer
114 views

Script to temporarily drop admin privileges

I am creating a self-control tool for administrators. The script when run by an administrator, would voluntarily drop admin privileges. The administrator can regain admin privileges by running the ...
6
votes
4answers
1k views

Examples of why a world readable /root directory is bad?

To add weight to a discussion I'm having, I'm trying to find concrete examples of why having the /root directory world readable is bad from a security point of view. I have found plenty of instances ...
3
votes
4answers
567 views

Why is resetting the root password allowed?

In Linux there is a way to reset the root password; why is this allowed? Anyone having access to the physical machine can change the root password, without knowing it. Is there is a way to protect ...
0
votes
2answers
114 views

How can I prevent a sudoer to change the LUKS master key?

There's an scenario that I'm worried about, and I'm not sure if it's possible to archieve. I got a machine with this setup: A LUKS-ciphered main system partition. An user with sudo access (added to ...
5
votes
2answers
2k views

How can I protect my user passwords and passphrase from root

How can I safely access "my" web services and accounts in a computer in which I do have sudo rights but the administrator(s) have, naturally, remote root access as well? Details I use a dekstop ...
3
votes
1answer
203 views

suid executibles work only when present in the system PATH

I have an executible which requires root privilages. But it seems to work only when it's present in the system path. When I execute it like this: $ ./prog The program complains of having no root ...
1
vote
1answer
330 views

Can a program run by a NOPASSWD sudoer use sudo to gain root access?

If my user account is a NOPASSWD sudoer, does that mean any program I run can effectively gain root access by using sudo? I noticed the default user on Raspbian is a NOPASSWD sudoer, and so I've been ...
0
votes
1answer
559 views

How to run firejail as root?

How can I run firejail as a root user? # firejail --seccomp firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/...
19
votes
2answers
4k views

Two root accounts, what to do?

I'm on Ubuntu 15.04 and today I've been reading an article about Linux security from this link. Everything went good until the part of UID 0 Account Only root should have the UID 0. Another ...
4
votes
2answers
515 views

Linux root access recovery by booting on the console

Very recently I recovered a root password for a Debian server by booting into single user mode. This resulted in me having access to a shell with root privileges (prompt said "root@none") Now this has ...
-2
votes
5answers
505 views

Why does superuser exist in Unix/Linux?

I know that some system tasks are permitted only to privileged users/processes, but still a super user (usually the root in Unix/Linux) or administrator can present so much problems in regards to ...
6
votes
3answers
1k views

What exactly differentiates the root user from every other user?

What are the fundamental differences between some arbitrary account and root? Is it just the UID being something other than zero? So, what exactly does the su binary do and how does it elevate a user ...
0
votes
3answers
98 views

What additional privileges does the root user have over a standard user? [closed]

What additional privileges does the root user have over a standard user in Linux?
63
votes
6answers
9k views

Why does reboot and poweroff require root privileges? [duplicate]

To restart or shut off Linux from the terminal, one can use reboot and poweroff, respectively. However, both of these commands require root privileges. Why is this so? What security risk is posed by ...
2
votes
3answers
1k views

Why root's password change doesn't require old password

Why can root's password can be changed without entering the old password? Is there any benefit to this or is it just an implementation fault? If we issue passwd from a normal user account it first ...
1
vote
1answer
973 views

Security - Runing Daemon, program as root or user vs sudo su

I have some questions about Linux security: Running a process as root is a big mistake (root has too much power + a program get too much permissions in the system). I always ran processes as a user (...
3
votes
1answer
69 views

How many check points in RHEL/CentOS to make sure no one have sudo/root access

I want to make sure no one has sudo access or root access on some production servers. Some points I have also verified like: grep 'x:0:' /etc/passwd grep root /etc/group cat /etc/sudoers key in /root/...
3
votes
3answers
4k views

Allow SSH access but restrict root's access to a given set of IPs

I want to allow SSH for all users as normal except that I want to restrict root's access based on a set of IP addresses. So, users peter, paul, lary can login from anywhere, but root may login only ...
1
vote
2answers
112 views

Prevent certain lines of a script to run as root

Suppose I am writing a shell script that requires root privileges to run, for example- #!/bin/sh ip -s -s neigh flush all ufw enable How can I prevent certain lines of code to be run as root, i.e. ...
1
vote
1answer
4k views

wheel groups and permissions

I'm new to a lot of things Linux, so this might be basic stuff. We're thinking about setting up a wheel group and removing permissions from root. Not even sure that's possible. We are having a ...
1
vote
2answers
145 views

How do I install programs in /usr/local if they shouldn't be compiled by root?

Somewhere in the back of my brain is the memory of reading a cautionary internet voice warning against compiling (i.e. running make) as the root user. Perhaps it's something like this story ...
4
votes
2answers
7k views

rkhunter warning about ssh root access when that access is not allowed on the system

I just ran rkhunter --check and all was good except this: Checking if SSH root access is allowed [ Warning] What does this warning mean? SSH root access is not allowed on this ...
1
vote
4answers
67 views

Can administrating task of 'root' be divided to the several of “more powerful” users?

Unlike root (which is able to do everything) is it possible to have multiple administrators assigned to manage only part of a system? For example, one system could have 3 administrators: Application ...
-4
votes
1answer
880 views

How to know su password

You already know my question. I don't have su authority. So I want to know su password. I really(x100) don't know how to find it. I tried change direction(/etc/pam.d/su) and tried to delete auth ...
15
votes
5answers
20k views

How to Determine the IP Address of who logged into Root?

There are several people with root access to a particular VM I am in charge of. I would like to find out which IP address was used to log into root.
1
vote
2answers
625 views

Execute scripts without decrypting them [duplicate]

I have a set of scripts (bash, ruby, python) and want to put everything into a container like file so I can deploy this container on a lot of servers. This scripts need to protect from accessing other ...
1
vote
1answer
934 views

Meaning of entries in /etc/securetty?

I've been given a set of entries to apply to /etc/securetty, what does each of them mean? console tty1cd / tty2 tty3 tty4 tty5 tty6 ttyS0 ttyS1 I'm especially interested in the "tty1cd /" entry. I ...
2
votes
1answer
140 views

Check that only root can edit a script before executing it

I have a script that needs to run as root. It also has a configuration file which is read using source: source conf.sh I would like to check that normal user can't edit conf.sh and therefore get ...
7
votes
3answers
1k views

Why are web servers traditionally started as superuser?

Thinking about a future web server setup, it struck me that for some reason web servers usually start as root and then drop certain rights (setuid) for the worker processes. In addition there is often ...
7
votes
2answers
3k views

Process in user mode switch to kernel mode. Then the process will have root privileges?

According to http://www.linfo.org/kernel_mode.html in paragraph 7: When a user process runs a portion of the kernel code via a system call, the process temporarily becomes a kernel process and is ...
34
votes
7answers
38k views

Can root/superuser read my read-protected files?

On shared unix hosting, if I have a file sensitive-data.txt and I issue: chmod 600 sensitive-data.txt Can root user still read my file? Specifically I'm wondering if it's safe to store my password ...
0
votes
2answers
1k views

Is it possible to make a standard user that can gain NO access to root?

I've set Kali Linux as the OS on a remote PC. Users will be connecting to it via SSH and I want to prevent them from gaining root access or using su or sudo command. I'd like to disable a variety of ...
3
votes
1answer
882 views

Reconfigure login through root ftp (lost ssh access)

My question is twofold. I need to somehow re-enable telnet and/or ssh in a device where I currently only have root ftp access. Also, if I am going about this wrong, please let me know. Details to ...
3
votes
1answer
2k views

How to disable root user on OpenBSD?

So there is a desktop and root permission isn't needed on it (or if it's needed, then reboot to single mode/whateverlivecd fix a config file-> get root, do the stuff with it and at the end, disable ...