gabriel rosenkoetter on Wed, 3 Jul 2002 03:23:33 -0400


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] log as root or not ?


On Tue, Jul 02, 2002 at 10:39:38PM -0400, Jesse Schultz wrote:
> On the other hand, having been an admin on Linux, Unix, NT and Novell 
> systems for the last decade, I can tell you that the changed prompts and 
> colored lights arent always there depending on the client, server, OS or 
> NOS you are using and who configured it.

Swell. I've been doing this at least half as long as you, and my
system Works for Me. Note that I'm not suggesting anyone else
should do things My Way, just that it is safe for them to do so.
(You, and several others, seem to be suggesting that everyone should
do things Your Way. I don't think that's either Necessary or Right.)

> ANY book or guide on Administration for any operating system you care to 
> read including linux will reccomend using root sparingly and not logging 
> in as root but rather changing to root for special tasks if that is 
> possible.

Again, "Use root sparingly," in NO way implies "do not log in as
root". The two are wholly separate constructs and there is no
logical reason to connect them.

My logic, that using su when administering remotely is more likely
to leak your root password to a passive eavesdropper (call her Eve)
or an active attacker (call him Mallory) in the network between you
and the host being administered, in fact does imply that using PKI
authentication to log in as root when you are ready to do root
things is safer. If your login crosses any edge or (heaven forfend)
core router which you do not control, you MUST be concerned about
Eve and Mallory.

I choose to leave the xterm in which I've connected as root up and
not do much with it except when I need to because I've got a lot of
(virtual) screen real estate. What you might choose to do is just
ssh root@localhost (presuming you're allowing agent forwarding to
the host in question) when you need root access. Doing so is
definitely more safe than using su(1). (Note that if, at any point,
you enter a shared secret over the wire, you've screwed up. Make
sure you understand how SSH agent forwarding works, and why you
shouldn't just use it blindly with every host out there.)

-- 
gabriel rosenkoetter
gr@eclipsed.net

Attachment: pgp1LFs0E0Zzj.pgp
Description: PGP signature