Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is obligatory.

  • What is the purpose of this password?
  • Provided I selected "Automtic Login", when will this password be asked of me?
share|improve this question
    
Relevant: askubuntu.com/a/245262/55633 –  Vorac Apr 9 '13 at 6:56
add comment

4 Answers

up vote 2 down vote accepted

The user password ought to be asked when doing an administrative operation (which more or else maps to a call to sudo or something similar). Out of a lot of reasons (including Tradition with a capital 'T'), you should never use the root account directly (except for emergencies); instead, you connect as a "normal user" who is registered (in the /etc/sudoers file or equivalent) as "capable of doing administrative tasks provided he enters his password".

Asking the user password explicitly for administrative operations avoids or at least reduces the nuisance implied by some cases of "lunch-time attacks": when someone forgets to lock his system, and a facetious coworker decides to abuse the situation.

share|improve this answer
    
Thank you for clearing up my little confusion.And both passwords can be reset in system recovery/root console, right? –  Vorac Feb 8 '13 at 8:36
    
I don't know the specifics of any graphical interface that RedHat/Fedora could come up with (my last RedHat installation was in 1997) but root can do anything including resetting the password of any user with the command passwd (passwd bob to change Bob's password, from a shell opened as root). –  Thomas Pornin Feb 8 '13 at 12:15
add comment

The root and user account are different accounts. You should never log in with the root account. You should always log in as a regular user and use sudo to elevate privileges temporarily to install programs or perform system maintenance. Actions performed by root are rather permanent, therefore you should use sudo so you think twice before executing a command.

Since the root and user account are different accounts, you will need to define two passwords. I strongly advice you to use different passwords for root and user accounts.

When you have selected automatic login, you shall need your password to perform actions that require superuser rights. For instance installing a new program, updating or altering configuration files.

Also have a read about this topic on serverfault: What's wrong with always being root?

share|improve this answer
add comment

The user account is different from the root account; they are literally two different user accounts on the system. Root is an unparalleled special account, your user account is just an arbitrary user account (likely set up with admin privileges by default). The user password is associated only with the user account, but can likely be used to perform root-level tasks by using sudo. The root password is required to login to the root account, but good practice is to never do that. In all likelihood you may never use the root password again.

If you select "automatic login" then the user password will not be asked for during boot up. However, it will be asked if you screensaver-style lock your machine, log out and log back in, or execute a sudo commend. Basically, any time you need to be authenticated except for the first bootup and login.

share|improve this answer
add comment

The user password can still be asked if you have automatic login to unlock the screen after you locked it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.