Question regarding Linux permissions

[M00T]

I like my sudo, thank you very much.

 

[Nothinman]

And prefixing all of your commands with 'sudo ' help you how?

 

[xSauronx]

Originally posted by: Nothinman

It's just that in a ideal world there should be no need for accessing root at all, except for very specific cases (such as installing software).

The problem is that installing software is a very, very common case. Breaking the common case to the point where you have to boot into single-user mode is retarded.

What would you consider ideal? I only have experience with Xubuntu, and like it for the most part, but have a new laptop in and think I may put a different distro on it.

Ive had previous, albeit minor, experience with linux over the years, having earlier tried RH 4 or 5 (i cant recall which, this was years and years ago) and Debian 3.0, and the idea of using sudo for everything seems weird just from previous experience, but honestly, i dont know the advantages/disadvantages of using sudo for everything as opposed to having to login as root (except, off the top of my head, that the user password being all thats needed for superuser permissions seems like a bad idea)

 

[drag]

It's much more convient to have sudo and it's usually a acceptable trade off. The idea is that you can do all sorts of extra stuff to nail down a Linux box, but realy if it interfers with normal usage of it (like Selinux breaking common applications) you will eventually just turn it off.

If you are the only user on a machine and don't have sudo, after a few months of using it you will eventually turn it on. Pretty much everybody does.

Stateless Linux is a effort to improve this for professional environments. With Stateless Linux your root is actually read-only. It boots up like a Knoppix system, but instead of having the image on a cdrom you have it on a remote server. Then you have a local drive cache for user's files and such that is mirrored on a server.

The basic idea people have for a read-only root to work is to set up Linux so that you never have to use root or sudo otherwise. That the system is self configuring and pretty much invisable to the end user. Common desktop tasks (such as configuring the display or input devices.. or burning a cdrom or accessing a network share) should be authenticated and carried out with regular user rights.

They have a similar sceme for the OLPC (the 100 dollar laptop for the developing world) were on your laptop the user's operating environment is actually a a virtual machine (Vserver-based) were the main system is essentially off limits and 'root' is a unprivilaged user (root in name only). In this way a system can be easily made free of any viruses, malware or bizzare configuratiosn by a simple 'reset' of the user environment. (not sure of all the details). This is enforced down to the hardware level and you'd need a special 'developer key' that is specific for a laptop to hack on the 'real' underlining OS.

 

[Nothinman]

What would you consider ideal? I only have experience with Xubuntu, and like it for the most part, but have a new laptop in and think I may put a different distro on it.

The way it is now is good enough for most setups. Traditional permissions and SELinux protect and compartmentalize the system enough. Security vs convenience is always a tradeoff and requiring you reboot into single-user mode just to update your system is very inconvenient and in most cases would just cause people to update less because of the hassle.

As for sudo, it's useful for delegating administrative tasks to people that you don't want to give the root password to and gksu is nice for things like the graphical updater but the benefits of requiring sudo for all admin access is questionable. And the logs are better than the .bash_history you'd get from a normal root shell, but the fact that there's only one user and their password works both for their account and root access isn't usually a good thing. All an attacker has to do is steal your password and get a shell somehow and they have root access and since bruteforcing root remotely isn't really an option since most daemons don't allow root logins by default they're going to be looking to attack your account anyway. And again there's the convenience factor, having to prefix all of your commands with sudo is a PITA since I'm used to having a root shell open all of the time.

 

[Brazen]

Originally posted by: iamaelephant
What the hell is wrong with the average linux user? I asked a simple question, clearly stating that I'm new to all of this, and I get sh!t like

lol....I love the "OMG!!1! Linux shouldn't be secure!!1!

Nothing better than a juicy linux box admin'ed by an idiot.

I am simultaneously struck with laughter and loathing when someone says something like "I don't need the safeguards, I know what I'm doing."

I'm not an idiot, I'm just new to this. You shouldn't expect people to just know something with no experience, it's ridiculous. This is why no one likes the Linux community - your extreme elitist attitudes. Thanks to the people who gave me sensible, coherent answers. I'm now aware that a totally unrestricted root account is not only unnecessary but also pretty much impossible.

For one thing, I specifically said that YOU were exempt from my remark; it was just something that came to mind. N0c's comment may have been a little harsh, but really he didn't mean anything by it, just poking fun.

There is nothing wrong about being new and inexperienced. You came to learn, and so you are being taught (and you've gathered some of the best in this thread, you should feel privileged). The methods may not be the best, but I don't think anyone here has a degree in Education.

 

[aidanjm]

It seems that you want to work as root in a gui environment. so that means opening the file browser (nautilus) or a text editing program as root. In kubuntu, you would open a terminal window and type:

kdesu konqueror


to launch the konqueror file browser as root (allows you to make any changes anywhere no questions asked so be careful!!!), or if you wanted to open a text editing program as root (allows you to save changes to any documents, config files, etc):

kdesu kate

or

kdesu kword


I don't use ubuntu as much, but I think the equivalent would be:

gksu nautilus

to open the nautilus file browser as root, or to open a text editor as root,

gksu [name of text editor, e.g., gedit]

 

[aidanjm]

Originally posted by: iamaelephant
I'm not an idiot, I'm just new to this. You shouldn't expect people to just know something with no experience, it's ridiculous. This is why no one likes the Linux community - your extreme elitist attitudes. Thanks to the people who gave me sensible, coherent answers. I'm now aware that a totally unrestricted root account is not only unnecessary but also pretty much impossible.

I think the problem is that linux, and unix-style operating systems in general, have some very different paradigms than the windows operating system. which means you may be a very clever windows user, but that might not help you when you move to linux, because the way things are done will seem a bit alien or odd.

to edit that text file, the typical approach would be to do it from the command line. In other words, you will need to open up a "terminal window" (can do this from the menu) and enter in some commands.

to change to the right directory, you use the "cd" command:

e.g.,

cd /etc/X11

type this in the terminal window, hit return, and you should be taken to the correct directory.

To list the contents of the directory you are in, type:

ls

To move up one level in the directory structure:

cd ..


To edit a text file, you could use any number of text editing programs (nano, gedit, vi, etc). I think nano is in ubuntu, so you could type:

nano xorg.conf

and a small text editor will open in the command window and allow you to edit the text.

If you prefer a gui text editor, you could try "gedit" by typing:

gedit xorg.conf

This should open up a new application window which will allow you to edit the test using the full mouse/ windows gui experience. You should be able to save changes by choosing the "save" option from the menu.

 

[aidanjm]

don't forget ubuntuforums.org as a place where ubuntu newbies and also more experienced ubuntu users can get helpful advice, and are less likely to encounter wankers waving their unix e-penises around.