Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I am doing a lot of sudo operations, I like to spawn a bash shell from sudo to make the operations go quicker. I am against assigning a root password because I do not like the root account enabled because it is an easy target for hackers.

There are a couple of security concerns I have with using sudo bash as well, but to me it seems safer than just enabling the root user all together.

Which option is safer? Using sudo bash to obtain a root level shell as a nomal user, or just enabling the root account and using su root to gain root access?

share|improve this question
3  
You left out a possibility. Access to the root account could be granted through /root/.ssh/authorized_keys. Then the only password involved would be that for the private key. And a brute force attack on the password could only be performed by somebody who managed to obtain a copy of the encrypted secret key. –  kasperd Jul 31 at 10:09

3 Answers 3

up vote 14 down vote accepted

For a single-user system, there's not much difference between the two from a security perspective: in either case, the attacker needs to guess one password to gain superuser privileges.

The big difference shows up in a situation where you've got multiple administrators. In that case, requiring sudo creates an audit trail of exactly who performed which administrative action.

share|improve this answer
    
How can you see who has done what? Are all shell commands for all users logged? –  SPRBRN Jul 31 at 10:21
1  
You can log who has sudo'd so that you know that the root account on a specific TTY has been accessed by a specific user. Of course you'd need to log the sudo command outside the OS's disks before the user finishes logging in if you have adversarial sysadmins :-) There should be tools for that but I don't know them (probably distro-specific, too). –  Steve DL Jul 31 at 10:36
3  
Most syslog utilities have the ability to log to a remote computer. Someone with sudo access can disable this, but the fact that they've disabled it will be logged. –  Mark Jul 31 at 19:36

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

share|improve this answer
1  
In addition to this, you can install fail2ban, which monitors login attempts and can block them based on failed attempts and ip address. So you can decide to block an ip address for 24 hours if it has 10 fails in 5 minutes - or whatever you like. –  SPRBRN Jul 31 at 10:18

I wouldn't assign a password to the root account, it makes guessing usernames too easy. I solved this "problem" by assigning my account to a admin group and gave this group sudo rights without the use of a password. Once you made a group and added yourself use visudo to alter the sudoers file and add the following line: %GROUPNAME ALL=NOPASSWD: ALL

Now you can use sudo without having to enter your password every time.

share|improve this answer
    
+1 Personally I don't mind using a password for sudo because I commonly walk away from my computer without locking the screen and it would be very easy for someone with physical access to get root access with no sudo password. –  John Jul 31 at 9:43
3  
How does assigning a password to root make guessing usernames easier? –  SPRBRN Jul 31 at 10:22
    
Because everybody knows the username root. You are right tho, it doesn't make guessing other usernames easier, just the root user. –  BadSkillz Jul 31 at 10:27
    
Anyone with access to the system can get the list of usernames for free: /etc/passwd is, and needs to be, world-readable. –  Mark Aug 1 at 23:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.