5

When I am doing a lot of sudo operations, I like to spawn a bash shell from sudo to make the operations go quicker. I am against assigning a root password because I do not like the root account enabled because it is an easy target for hackers.

There are a couple of security concerns I have with using sudo bash as well, but to me it seems safer than just enabling the root user all together.

Which option is safer? Using sudo bash to obtain a root level shell as a nomal user, or just enabling the root account and using su root to gain root access?

Improve this question
1
  • 5
    You left out a possibility. Access to the root account could be granted through /root/.ssh/authorized_keys. Then the only password involved would be that for the private key. And a brute force attack on the password could only be performed by somebody who managed to obtain a copy of the encrypted secret key.
    – kasperd
    Commented Jul 31, 2014 at 10:09

3 Answers 3

Reset to default
14

For a single-user system, there's not much difference between the two from a security perspective: in either case, the attacker needs to guess one password to gain superuser privileges.

The big difference shows up in a situation where you've got multiple administrators. In that case, requiring sudo creates an audit trail of exactly who performed which administrative action.

Improve this answer
3
  • How can you see who has done what? Are all shell commands for all users logged?
    – SPRBRN
    Commented Jul 31, 2014 at 10:21
  • 1
    You can log who has sudo'd so that you know that the root account on a specific TTY has been accessed by a specific user. Of course you'd need to log the sudo command outside the OS's disks before the user finishes logging in if you have adversarial sysadmins :-) There should be tools for that but I don't know them (probably distro-specific, too).
    – Steve Dodier-Lazaro
    Commented Jul 31, 2014 at 10:36
  • 3
    Most syslog utilities have the ability to log to a remote computer. Someone with sudo access can disable this, but the fact that they've disabled it will be logged.
    – Mark
    Commented Jul 31, 2014 at 19:36
11

Who are you worried about?

Attacks from the Internet on e.g. SSH? You can prevent them in SSH, or limit root logins to local TTYs. See the Red Hat documentation for tips.

Attacks from family and friends? Then you should remember that sudo leaves your root account accessible without password for a few minutes, so they could sudo su and then passwd. You might still want to monitor your root account if you live with people who like to prank!

Attacks from malware running on your session? Then your only way to stay safe is to login as root only in a TTY and not to use sudo at all. Anything you type in your X11 session (the root password or your own with sudo or gksudo or kdesu) can be stolen by any (visible or not visible) process through the X API, and commands can then trivially be injected in the terminal with a root access. Keylogging the whole session is also trivial.

Improve this answer
1
  • 1
    In addition to this, you can install fail2ban, which monitors login attempts and can block them based on failed attempts and ip address. So you can decide to block an ip address for 24 hours if it has 10 fails in 5 minutes - or whatever you like.
    – SPRBRN
    Commented Jul 31, 2014 at 10:18
1

I wouldn't assign a password to the root account, it makes guessing usernames too easy. I solved this "problem" by assigning my account to a admin group and gave this group sudo rights without the use of a password. Once you made a group and added yourself use visudo to alter the sudoers file and add the following line: %GROUPNAME ALL=NOPASSWD: ALL

Now you can use sudo without having to enter your password every time.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .