Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #183420 > unrolled thread

How to gain control over the system?

Back to article view | Back to linux.debian.user

Contents

  How to gain control over the system? Kaj Persson <70147persson@telia.com> - 2017-07-09 00:10 +0200
    Re: How to gain control over the system? Oflameo <oflameo2@gmail.com> - 2017-07-09 00:30 +0200
      Re: How to gain control over the system? Fungi4All <fungilife@protonmail.com> - 2017-07-09 01:00 +0200
        Re: How to gain control over the system? Anders Andersson <pipatron@gmail.com> - 2017-07-09 11:30 +0200
          Re: How to gain control over the system? Dejan Jocic <jodejka@gmail.com> - 2017-07-09 12:00 +0200
    Re: How to gain control over the system? davidson@freevolt.org - 2017-07-09 01:30 +0200
      Re: How to gain control over the system? Fungi4All <fungilife@protonmail.com> - 2017-07-09 12:10 +0200
        Re: How to gain control over the system? Richard Owlett <rowlett@cloud85.net> - 2017-07-09 13:50 +0200
    Re: How to gain control over the system? Kaj Persson <70147persson@telia.com> - 2017-07-09 15:10 +0200
      Re: How to gain control over the system? [a security-side-note] Eike Lantzsch <zp6cge@gmx.net> - 2017-07-09 16:00 +0200
        Re: How to gain control over the system? [a security-side-note] Dejan Jocic <jodejka@gmail.com> - 2017-07-09 16:20 +0200
      Re: How to gain control over the system? Fungi4All <fungilife@protonmail.com> - 2017-07-09 19:00 +0200
        Re: How to gain control over the system? Kaj Persson <70147persson@telia.com> - 2017-07-09 19:10 +0200
          Re: How to gain control over the system? Kaj Persson <70147persson@telia.com> - 2017-07-09 23:40 +0200
      Re: How to gain control over the system? Felix Miata <mrmazda@earthlink.net> - 2017-07-10 01:40 +0200
        Re: How to gain control over the system? Kaj Persson <70147persson@telia.com> - 2017-07-11 22:40 +0200
          Re: How to gain control over the system? David Wright <deblis@lionunicorn.co.uk> - 2017-07-11 23:00 +0200
            Re: How to gain control over the system? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-07-11 23:10 +0200
          Re: How to gain control over the system? Felix Miata <mrmazda@earthlink.net> - 2017-07-12 03:50 +0200
            Re: How to gain control over the system? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-07-12 14:30 +0200
            Re: How to gain control over the system? Kaj Persson <kape_fin@algonet.se> - 2017-07-13 12:30 +0200
              Re: How to gain control over the system? <tomas@tuxteam.de> - 2017-07-13 13:20 +0200
                Re: How to gain control over the system? Fungi4All <fungilife@protonmail.com> - 2017-07-13 14:20 +0200
                  Re: How to gain control over the system? <tomas@tuxteam.de> - 2017-07-13 15:20 +0200
                Re: How to gain control over the system? tomas@tuxteam.de - 2017-07-13 15:20 +0200
                  Re: How to gain control over the system? David Wright <deblis@lionunicorn.co.uk> - 2017-07-13 16:30 +0200
    Re: How to gain control over the system? Jimmy Johnson <field.engineer@gmail.com> - 2017-07-09 22:30 +0200
      Re: How to gain control over the system? Kaj Persson <kape_fin@algonet.se> - 2017-07-10 00:40 +0200
        Re: How to gain control over the system? Jimmy Johnson <field.engineer@gmail.com> - 2017-07-10 00:50 +0200
        Re: How to gain control over the system? Joel Rees <joel.rees@gmail.com> - 2017-07-10 03:10 +0200
        Re: How to gain control over the system? Dejan Jocic <jodejka@gmail.com> - 2017-07-10 10:00 +0200
        Re: How to gain control over the system? RavenLX <ravenlx@sitesplace.net> - 2017-07-12 14:40 +0200
          Re: How to gain control over the system? <tomas@tuxteam.de> - 2017-07-12 15:30 +0200
            Re: How to gain control over the system? RavenLX <ravenlx@sitesplace.net> - 2017-07-16 15:50 +0200
              Re: How to gain control over the system? <tomas@tuxteam.de> - 2017-07-16 16:50 +0200

Page 2 of 2 — ← Prev page 1 [2]

#183639

On 2017-07-12 at 03:49, Felix Miata wrote:
> Kaj Persson composed on 2017-07-11 22:29 (UTC+0200):
> ...
>> ls -Al /home:
>> drwxr-xr-x 39 kaj  kaj  16384 jul 11 17:23 kaj
> OK...
>
>> and from the command
>> tree -qpadxugL 2 /home:
>> /home
> ...
>> │   ├── [drwxrwx--- root     kaj     ]  DATA
> ...
>> │   ├── [drwxrwx--- root     kaj     ]  Hämtningar
> ...
>> │   ├── [drwxrwx--- root     kaj     ]  Musik
>> │   ├── [drwxrwx--- root     kaj     ]  Nedladd
> ...
> Definitely not OK, making one wonder what lurks deeper or elsewhere.
>
>> and from
>> tree -qpadxugL 3 /home/kaj/.config:
> OK only as deep as you went.
>
> ...
>> I see nothing which gives me an idea of what is wrong. Are there any
>> more files or directories to look at? In /etc perhaps?
> You're not done looking. Until you get all the way to the bottom, you can't know
> what else is wrong. You apparently need depth of at least 3 in the other hidden
> directories, at least 4 in .config, and probabliy 4 or more in all.
>
> Again:
>
> 	chown -R 1000:1000 /home/kaj/
>
> as root should fix them all. If it doesn't, chown would seem to be broken.
>
> Maybe this in addition?
>
> 	chown -R 1000:1000 /home/kaj/.*
>
>
> Try MC in fullscreen mode. That way every listing you can see will display
> ownership.
Some of you did react strongly on the ownership on some of the 
directories. They are owned by root and have group access by group kaj 
(1000). I tried to shortly explain why. They are mounted vfat 
partitions, and as far as I have succeeded to mount them, this is the 
result. I suppose that those people are purists with not too big 
experience of mixed environments. If I go solely with ext4 partitions, 
all this is much easier, but I have reasons to have at least half a 
window open towards the Microsoft world with common data, so that's it. 
Maybe ntfs is a better choice, and simpler to manage, but at that time, 
many years ago when I had to chose, the support for that file system was 
not sufficiently good, so my choice became vfat.

As always only root can mount a file system. In the case vfat, which 
does not have an access system by its own, the owner of the mounted 
system will be root. According to "man mount" you could put the option 
uid=1000 (or any), and I do so in my fstab, but at least I have not got 
this to work. However gid=1000 works fine, and that way I get full 
access to the vfat partitions. I use umask=007. Possibly you could use 
707, but this has not caused me any problems during all these years I 
have used this method. And these vfat partitions are used purely for 
user data: photos, documents, downloads etc. Unpacking the downloads are 
normally performed in an ext4 partition and run from there. Moreover 
chown has no impact on these mounts. The only way to change the 
ownership (which does not work) or group, is by umount and a new mount. 
Not even the option remount has any effect, at least according to my 
experience. Also, all files and all subdirectories inherit the owner and 
group properties from its parents all way up, so strictly it is 
sufficient to look at the top level of all mounts. In my case all mounts 
except /usr/local are mounted at subdirectories of /mnt. Then some of 
them have got an extra entry via mount --bind in $HOME, and it is those 
you see in the list with root as the owner. I have looked at all files 
down to the bottom of the tree, but this list is not suitable to present 
in this forum, much too long. Already the previous lists were too big, 
but I wanted you to see the principle. Nowhere in this huge list I can 
see an incorrect root influence.

BUT! What I lack is power to arrange my desktop and panels. Isn't there 
some file somewhere in which I should be set access to these facilities, 
something like sudo access? Maybe a group I should belong to, or 
something like this? I do not have enough knowledge of all this, but I 
hope someone in the forum will have.

/Kaj

[toc] | [prev] | [next] | [standalone]

#183640

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jul 13, 2017 at 12:08:27PM +0200, Kaj Persson wrote:

[...]

> As always only root can mount a file system. In the case vfat, which
> does not have an access system by its own, the owner of the mounted
> system will be root.

As a hint (I'm not a purist, mind you): I always mount vfat (well,
at least when I plan to access them as regular user):

  sudo mount -ouid=tomas,gid=tomas /dev/sdb1 /mnt

This makes my life easier (yes, you can put the user name in there,
and separating uid=foo,gid=bar with a comma (no space!) should
work for you.

As to your original problem... sorry.

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAllnVdIACgkQBcgs9XrR2kYtnwCfTqIpa9KgpccLP9pC31xEas7v
9TYAn1z/3Zwcv+lNQvGS4Y33btjsptE6
=IyrH
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#183643

[Multipart message — attachments visible in raw view] — view raw

> UTC Time: July 13, 2017 11:13 AM
> From: tomas@tuxteam.de
> To: debian-user@lists.debian.org
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> On Thu, Jul 13, 2017 at 12:08:27PM +0200, Kaj Persson wrote:
> [...]
>> As always only root can mount a file system. In the case vfat, which
>> does not have an access system by its own, the owner of the mounted
>> system will be root.
> As a hint (I"m not a purist, mind you): I always mount vfat (well,
> at least when I plan to access them as regular user):
> sudo mount -ouid=tomas,gid=tomas /dev/sdb1 /mnt
> This makes my life easier (yes, you can put the user name in there,
> and separating uid=foo,gid=bar with a comma (no space!) should
> work for you.
> As to your original problem... sorry.
> Cheers

Minor note and question:
If he or anyone else is using other than MSwin more than one linux/unix
system with a common /home partition and wants access to the
same /home/user if "user" corresponds to 1001 in Debian and 1003 in
LinuxX then the name user will not allow access to the other system as
on is user 1001 and the other 1003, two different users with the same
label. The other way around seems to work with my experience, if
1002 is Deb on one system and 1002 is Ian on another then it shows
as the same user. The true owner is described by the id not the label,
I think!

[toc] | [prev] | [next] | [standalone]

#183646

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jul 13, 2017 at 08:12:46AM -0400, Fungi4All wrote:
> > UTC Time: July 13, 2017 11:13 AM
> > From: tomas@tuxteam.de
> > To: debian-user@lists.debian.org
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > On Thu, Jul 13, 2017 at 12:08:27PM +0200, Kaj Persson wrote:
> > [...]
> >> As always only root can mount a file system. In the case vfat, which
> >> does not have an access system by its own, the owner of the mounted
> >> system will be root.
> > As a hint (I"m not a purist, mind you): I always mount vfat (well,
> > at least when I plan to access them as regular user):
> > sudo mount -ouid=tomas,gid=tomas /dev/sdb1 /mnt
> > This makes my life easier (yes, you can put the user name in there,
> > and separating uid=foo,gid=bar with a comma (no space!) should
> > work for you.
> > As to your original problem... sorry.
> > Cheers
> 
> Minor note and question:
> If he or anyone else is using other than MSwin more than one linux/unix
> system with a common /home partition and wants access to the
> same /home/user if "user" corresponds to 1001 in Debian and 1003 in
> LinuxX then the name user will not allow access to the other system as
> on is user 1001 and the other 1003, two different users with the same
> label. The other way around seems to work with my experience, if
> 1002 is Deb on one system and 1002 is Ian on another then it shows
> as the same user. The true owner is described by the id not the label,
> I think!

I couldn't really follow your thoughts. It is simple: the command
"mount" translates the user and group names to some IDs according
to whatever mapping is defined in the current /etc/passwd.

Windows... is another story completely.

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAllncpkACgkQBcgs9XrR2kZDsgCfX5QhwauiGu4Hk1hw5cKDzl+6
jZcAn1lo3C8WaUrRoJCDxp0ZOavAVudQ
=S/Z9
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#183645

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jul 13, 2017 at 01:34:39PM +0200, Kaj Persson wrote:

[...]

[added cc debian-user]

> Can you have this defined from /etc/fstab too? I have had no success
> in that.

This line in the fstab works for me (note: no systemd here; systemd
is known to do things with mounting, so results may vary):

  # <file system> <mount point>   <type>  <options>                           <dump>  <pass>
  /dev/sdb1       /media/usb0     auto    rw,user,noauto,uid=tomas,gid=tomas  0       0

Season to taste :-)

Fixed entries in fstab are of limited use for removable media, though:
you never know which device your stick appears as (you might use label
or UUID, depending on your use case).

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAllncZ8ACgkQBcgs9XrR2kb5MQCfRgJDrdom249bF3L+0R7bLTtM
miwAnjWQ6TXWUN3NO/5Ckbi7sKcpSgKv
=+B/y
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#183650

On Thu 13 Jul 2017 at 15:11:59 (+0200), tomas@tuxteam.de wrote:
> On Thu, Jul 13, 2017 at 01:34:39PM +0200, Kaj Persson wrote:
> 
> [...]
> 
> [added cc debian-user]
> 
> > Can you have this defined from /etc/fstab too? I have had no success
> > in that.
> 
> This line in the fstab works for me (note: no systemd here; systemd
> is known to do things with mounting, so results may vary):
> 
>   # <file system> <mount point>   <type>  <options>                           <dump>  <pass>
>   /dev/sdb1       /media/usb0     auto    rw,user,noauto,uid=tomas,gid=tomas  0       0
> 
> Season to taste :-)
> 
> Fixed entries in fstab are of limited use for removable media, though:
> you never know which device your stick appears as (you might use label
> or UUID, depending on your use case).

Another way that works for me is lines like:

UUID=2017-0401 /media/esxplore4g vfat rw,errors=remount-ro,utf8,shortname=lower,user,noauto,fmask=137,dmask=027

With this, whoever mounts it owns it and gets rw-r----- (files) and
drwxr-x--- (directories). All our sticks/cards etc have individual
mount points, and mount by UUID (fat) or LABEL (ext/fat).
The mount points are all created  drwx------ root root
with identical timestamps, so any with devices mounted on them can
easily be spotted.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#183470

On 07/08/2017 02:57 PM, Kaj Persson wrote:
> Hi all,
>
> So can someone help me get the command back, or do I have to make a new
> reinstall, hoping for better luck. Possibly setting a password on the
> Admin, hence activating that account, which I would prefer not having to.
>
> Thank you in advance
> Kaj

Hi,

Start the Stretch install cd/dvd in repair mode and when you get to 
where you can start a shell in the install at the prompt type:# passwd 
root and then enter the new root passwd and then reboot.
-- 
Jimmy Johnson

Debian Buster - KDE Plasma 5.8.7 - Intel G3220 - EXT4 at sda14
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#183477

Hi Jimmy,
Well, I did not follow your suggestion exactly, but as people has said, 
the root account is already and always  there, even it has not been 
assigned a password. So, against my real whish, not to activate the root 
account, I gave the command sudo passwd root, and entered a password. 
And now I suppose I have burned my ships and have no way back...

But! Nothing has changed. I can still not enter program icons to the 
panel, and not define keyboard shortcuts. If I sort the icons on the 
desktop they still, after a cold start, come back in a completely other 
order, dispite I had marked "Keep ajusted" (right click on desktop).

So...?
/Kaj

Den 2017-07-09 kl. 22:28, skrev Jimmy Johnson:
> On 07/08/2017 02:57 PM, Kaj Persson wrote:
>> Hi all,
>>
>> So can someone help me get the command back, or do I have to make a new
>> reinstall, hoping for better luck. Possibly setting a password on the
>> Admin, hence activating that account, which I would prefer not having 
>> to.
>>
>> Thank you in advance
>> Kaj
>
> Hi,
>
> Start the Stretch install cd/dvd in repair mode and when you get to 
> where you can start a shell in the install at the prompt type:# passwd 
> root and then enter the new root passwd and then reboot.

[toc] | [prev] | [next] | [standalone]

#183478

On 07/09/2017 03:11 PM, Kaj Persson wrote:
> Hi Jimmy,
> Well, I did not follow your suggestion exactly, but as people has said,
> the root account is already and always  there, even it has not been
> assigned a password. So, against my real whish, not to activate the root
> account, I gave the command sudo passwd root, and entered a password.
> And now I suppose I have burned my ships and have no way back...
>
> But! Nothing has changed. I can still not enter program icons to the
> panel, and not define keyboard shortcuts. If I sort the icons on the
> desktop they still, after a cold start, come back in a completely other
> order, dispite I had marked "Keep ajusted" (right click on desktop).
>
> So...?
> /Kaj

I don't do sudo nor do I top post.  Maybe you should start over and this 
time use the net install, you will be given the option to install task mate.

Good luck.
-- 
Jimmy Johnson

Debian Buster - KDE Plasma 5.8.7 - Intel G3220 - EXT4 at sda14
Registered Linux User #380263

[toc] | [prev] | [next] | [standalone]

#183482

On Mon, Jul 10, 2017 at 7:11 AM, Kaj Persson <kape_fin@algonet.se> wrote:
> Hi Jimmy,
> Well, I did not follow your suggestion exactly, but as people has said, the
> root account is already and always  there, even it has not been assigned a
> password. So, against my real whish, not to activate the root account, I
> gave the command sudo passwd root, and entered a password. And now I suppose
> I have burned my ships and have no way back...

Of course you have a way back.

   man vipw

   man 5 passwd

   man 5 shadow

and note the -s option.

   man nologin

   man false

Then

   sudo vipw

and change the line for root (should be the very first line) to give it
either /bin/false or /sbin/nologin as the default shell for root.

(That's the last field.)

   cat /etc/passwd

after you're done, to make sure you saved it. Then,

   sudo vipw -s

and replace the encrypted password (second ffield) there with '*'.

 > But! Nothing has changed. I can still not enter program icons to the panel,
> and not define keyboard shortcuts. If I sort the icons on the desktop they
> still, after a cold start, come back in a completely other order, dispite I
> had marked "Keep ajusted" (right click on desktop).
>
> So...?
> /Kaj

Have you checked group ownership and  permissions?

Also, have you checked your mount parameters?

And have you checked whether you have established SELinux or acl
permissions or anything of that ilk?

(BTW, do you keep a backup of your /home partition? I usually find
myself using cp -p or tar to copy the files from the old /home to the
new one, instead of keeping an old /home around.)

-- 
Joel Rees

One of these days I'll get someone to pay me
to design a language that combines the best of Forth and C.
Then I'll be able to leap wide instruction sets with a single #ifdef,
run faster than a speeding infinite loop with a #define,
and stop all integer size bugs with my bare cast.
http://defining-computers.blogspot.com/2017/06/reinventing-computers.html

More of my delusions:
http://reiisi.blogspot.com/2017/05/do-not-pay-modern-danegeld-ransomware.html
http://reiisi.blogspot.jp/p/novels-i-am-writing.html

[toc] | [prev] | [next] | [standalone]

#183492

On 10-07-17, Kaj Persson wrote:
> Hi Jimmy,
> Well, I did not follow your suggestion exactly, but as people has said, the
> root account is already and always  there, even it has not been assigned a
> password. So, against my real whish, not to activate the root account, I
> gave the command sudo passwd root, and entered a password. And now I suppose
> I have burned my ships and have no way back...
> 
> But! Nothing has changed. I can still not enter program icons to the panel,
> and not define keyboard shortcuts. If I sort the icons on the desktop they
> still, after a cold start, come back in a completely other order, dispite I
> had marked "Keep ajusted" (right click on desktop).
> 
> So...?
> /Kaj
> 

What are you talking about, there are several ways to lock your root
account? Not sure why you would like to though. You can lock it with
sudo, like this:

sudo passwd -l root

But that is not really necessary. Better would be to learn how to
strengthen your root account. Depending on what you really want to
achieve, you can set it up so only way to access it would be to use su,
or sudo from trusted accounts. If you are interested in that, further
reading you can find here:

https://www.centos.org/docs/5/html/5.1/Deployment_Guide/s2-wstation-privileges-noroot.html

[toc] | [prev] | [next] | [standalone]

#183602

On 07/09/2017 06:11 PM, Kaj Persson wrote:
> Hi Jimmy,
> Well, I did not follow your suggestion exactly, but as people has said,
> the root account is already and always  there, even it has not been
> assigned a password. So, against my real whish, not to activate the root
> account, I gave the command sudo passwd root, and entered a password.
> And now I suppose I have burned my ships and have no way back...

[Snip]

To remove the root password so root can't log in again:

sudo passwd -l root

It'll report that the root password expiry has changed:

from man passwd:

   -l, --lock
Lock the password of the named account. This option disables a password 
by changing it to a value which matches no possible encrypted value (it 
adds a ´!´ at the beginning of the password).

Note that this does not disable the account. The user may still be able 
to login using another authentication token (e.g. an SSH key). To 
disable the account, administrators should use usermod --expiredate 1 
(this set the account's expire date to Jan 2, 1970).

Users with a locked password are not allowed to change their password.

[end of man entry]

Now, nobody can log in as root. But, root account is still there if you 
need it. To get it back and give it a password:

sudo passwd -u root
sudo passwd root

(Then type in a secure password for root.)

[toc] | [prev] | [next] | [standalone]

#183606

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Jul 12, 2017 at 08:30:12AM -0400, RavenLX wrote:

[...]

> To remove the root password so root can't log in again:
> 
> sudo passwd -l root

I've been following this back-and-forth for a while. Yes, I think it's
a good idea to use the root account as little as possible. Myself, I
use sudo in the overwhelming majority of cases.

But I learnt the hard way that sometimes it's a good idea to keep a
root account (with a corresponding password!) around.

When the system boots and the root file system is corrupt (or a
similar early-boot problem happens), you find yourself staring at
a message more or less looking like that:

  Please enter your root password to start a rescue shell:

(message is from memory, but you get the -uh- message).

This was shortly after Debian convinced me that having a root password
is The Evil Itself.

Duh.

I'm wiser now.

(Yah, there is a workaround for that: a rescue disk, and that's how
I got myself out of that, but hey).

Of course: no remote login as root (sshd_config). Use sudo in normal
life (it's more comfortable, anyway). All that. Use a hard-to-guess
root password (pwgen -n 16, for me).

But. A root password doesn't make your system more insecure (unless
it opens up one more remote access). And sometimes, just sometimes
you wish you had one :-)

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAllmIlkACgkQBcgs9XrR2kbbrQCeMEk2yo4l//4fQ6EmfVKZdCI8
NO8An3h/C2QqwlJU77AjzwDo0y5eRQYe
=dq9G
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#183742

On 07/12/2017 09:21 AM, tomas@tuxteam.de wrote:

[snip]

> I've been following this back-and-forth for a while. Yes, I think it's
> a good idea to use the root account as little as possible. Myself, I
> use sudo in the overwhelming majority of cases.
>
> But I learnt the hard way that sometimes it's a good idea to keep a
> root account (with a corresponding password!) around.
>
> When the system boots and the root file system is corrupt (or a
> similar early-boot problem happens), you find yourself staring at
> a message more or less looking like that:
>
>   Please enter your root password to start a rescue shell:
>
> (message is from memory, but you get the -uh- message).
>
> This was shortly after Debian convinced me that having a root password
> is The Evil Itself.
>
> Duh.
>
> I'm wiser now.
>
> (Yah, there is a workaround for that: a rescue disk, and that's how
> I got myself out of that, but hey).

I have only used a rescue disk once many years ago. That was because of 
a failing hard drive. Got the data from it OK, thankfully.

> Of course: no remote login as root (sshd_config). Use sudo in normal
> life (it's more comfortable, anyway). All that. Use a hard-to-guess
> root password (pwgen -n 16, for me).
>
> But. A root password doesn't make your system more insecure (unless
> it opens up one more remote access). And sometimes, just sometimes
> you wish you had one :-)

I use a laptop but I've never needed to ssh into a laptop computer. 
Also, if you want to set up ssh, add ssh client and set up your user 
(sudo enabled) account and random obscure port in sshd config. Be sure 
to set it up so that it uses a key pair. Then you still won't need root 
over ssh.

I'm not totally convinced that having a root account accessible 24/7 is 
a good idea, especially on portable systems that can also be accessed 
via internet.

[toc] | [prev] | [next] | [standalone]

#183747

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Jul 16, 2017 at 09:42:46AM -0400, RavenLX wrote:

[...]

> I use a laptop but I've never needed to ssh into a laptop computer.
> Also, if you want to set up ssh, add ssh client and set up your user
> (sudo enabled) account and random obscure port in sshd config. Be
> sure to set it up so that it uses a key pair. Then you still won't
> need root over ssh.

I must have been unclear. I think I explicitly discouraged from
allowing root login via SSH (this is the general recommendation
out there anyway).

The *only* case a root account (with password) may help is a
busted boot (e.g. by a root FS file system check dropping into
an interactive root session, among other things). There, you
need a root password (or alternatively, a rescue medium, if
you have one handy). And in this case (root login with password
restricted to physical presence) there is no security downside,
in the "normal" case (i.e. laptop or workstation). A kiosk
or (physically remote) server is a different story, though.

Cheers
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAllrer8ACgkQBcgs9XrR2kY5ZACfbrpofJQNLQP86QgM7AVRyXgL
qgIAnimLiZVrAverAnPcJYp1JYOCniLF
=C82S
-----END PGP SIGNATURE-----

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web