Torvalds: requiring root password for mundane things is "moronic"
Linked by Thom Holwerda on Tue 28th Feb 2012 23:11 UTC
Linux Linus Torvalds on requiring the root password for mundane tasks. "So here's a plea: if you have anything to do with security in a distro, and think that my kids (replace 'my kids' with 'sales people on the road' if you think your main customers are businesses) need to have the root password to access some wireless network, or to be able to print out a paper, or to change the date-and-time settings, please just kill yourself now. The world will be a better place." Yes, it's harsh (deal with it, Finns don't beat around the bush), but he's completely and utterly right. While there's cases where it makes sense to disable certain settings (public terminals, for instance), it is utterly idiotic that regular home users have to type in their root password for such mundane tasks.
E-mail Print r 8   100 Comment(s) http://osne.ws/jsr
Thread beginning with comment 508996
To view parent comment, click here.
To read all comments associated with this story, please click here.
laffer1
Member since:
2007-11-09

This is wrong. sudo is great for desktops. However, for servers, you should never use sudo. Why? Most servers have servers such as openssh and mail running. That means someone can brute force your password remotely. If you have a root password set, then even if they get into your account, they must take the time to brute force root. Hopefully this extra time will make it possible for someone to notice the attack.

Full sudo rights on a server == full root for everyone on the internet courtesy of botnets.

Reply Parent Score: 3

Nico57 Member since:
2006-12-18

Then just don't run services under a sudoer's account...

Reply Parent Score: 1

bert64 Member since:
2007-04-23

Which is why authentication via SSH keys is a good idea...
Now brute force attempts will be ineffective, and you also have two factors required in order to gain elevated privileges so even if someone steals your privatekey they still need to do extra work (and thus increase the risk of detection) in order to get root.

Reply Parent Score: 3

Soulbender Member since:
2005-08-18

However, for servers, you should never use sudo.


No, it's great for servers and should always be used since it enables better permission control and audit trails.

Most servers have servers such as openssh and mail running.


That's why you don't use password authentication with ssh. If you need people to use sftp with passwords you always use chroot and force the accounts to be sftponly.
Most servers do not have mail running and for those that do the email username and password are more often than not different from the system users and passwords.

Hopefully this extra time will make it possible for someone to notice the attack.


If they didn't already catch the brute force on the account I doubt they'll catch the brute force on root.

Full sudo rights on a server == full root for everyone on the internet courtesy of botnets.


100% wrong.

Reply Parent Score: 4

laffer1 Member since:
2007-11-09

Most people setup sudo to gain full access, not to run select programs. Of course it's capable of that, but it's rarely used in the wild. Most linux distros ship with it enabled like a root account.

I've seen people enable sshd on root accounts without using a key. Then they got owned. Everyday I see brute force attempts against root on my server. It's ignorant because BSD defaults to root disabled. They also had sudo turned on.

Like any tool, sudo can be used correctly but unfortunately people don't use it this way. Just because you setup your server competently doesn't mean it's common.

As for mail servers, I wasn't talking enterprise here. No LDAP. I'm thinking web hosting, virtual private servers and small shops. Anyone using sendmail + an imap server is probably using system accounts. That's default. Some of those accounts probably have shell access, especially in a hosting scenario. You don't have to agree with me, but I've seen it. I used to work for hosting companies.

Reply Parent Score: 2

Read more of this thread... >