Revisions to Is it better to use a root password, or use 'sudo bash'?

replaced http://askubuntu.com/ with https://askubuntu.com/

Source Link

edited Apr 13, 2017 at 12:22

1

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

I don't get the point about the SSH server, please clarify. You can already trivially keylog a X session by using XTest in your local malware and any form of network communication to your remote server.

Source Link

edited Jul 31, 2014 at 13:46

Steve Dodier-Lazaro

6.9k
31
45

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

I don't get the point about the SSH server, please clarify. You can already trivially keylog a X session by using XTest in your local malware and any form of network communication to your remote server.

Source Link

edited Jul 31, 2014 at 13:35

Steve Dodier-Lazaro

6.9k
31
45

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X applicationAPI, and commands can then trivially be injected in the terminal with a root access. If you are connected to a SSH server and have enabled X forwarding, that server can also keylog you.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) X application, and commands can then trivially be injected in the terminal with a root access. If you are connected to a SSH server and have enabled X forwarding, that server can also keylog you.

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access.