0

One common security practice is creating a low privilege account to work from, when not installing any tools or making system changes. This question is more towards penetration testing platforms. In Kali, Parrot and other Platforms they have taken away the root user account and only gave sudo permissions. However, many, if not most of the tools, require using sudo to use them. So is there really a point in creating a low-privilege accounts in platforms such as these? Especially since you are going to be switching between the two quite a bit?

1
  • 2
    Given you tagged this for Kali: No, you're expected to know what you're doing.
    – user163495
    Commented Dec 8, 2021 at 22:14

2 Answers 2

1

For operating systems that are more intended as tools rather than platforms for creating things of value, it's not as important to maintain strict least privilege and user permissions boundaries. That's especially true if the environment is ephemeral, which is often (though not always) the case with pentesting-focused distros.

With that said, pentesting tools are themselves vulnerable to security issues sometimes (I've seen CTFs where a significant amount of the effort was spent on compromising other teams, typically through vulnerable Wireshark dissectors). Especially if you're poking at something that you expect might be (or is known to be) malicious, you'd want to be quite careful. Sometimes that just means "run the tools in a throw-away sandbox and record everything of interest outside of it", but sometimes you still care about preventing total compromise of everything across your Kali instance, etc.

Of course, not using root / sudo doesn't actually prevent compromise of the process in question, and even low-privilege processes can usually do quite a lot unless sandboxed. Most of the things an attacker might find interesting in a pentest environment are things that the low-priv user already has access to. (Indeed, this is true for non-pentest environments too; see https://xkcd.com/1200/)

Note that in modern distros, you don't really "switch between" root and non-root. You just use sudo for any command that requires it. Similarly, you don't create "a low-privilege account", you just create an account that, because it's not root (but is in wheel), can do low-priv stuff without sudo and high-priv stuff with. Also, even passwordless sudo will save you from accidentally making many bad mistakes (e.g. deleting files from the wrong directory), though it doesn't add any real security.

0

However, many if not most of the tools require using sudo to use them, so is there really much point in creating a low-privilege account in platforms such as these?

Asking "is there really much point" is vague because we don't know what you consider to be "much point." There is at least a point--the point being that there is a difference between doing everything as root and doing some things with sudo.

Especially, since you are going to be switching between the two quite a bit?

Switching between what two? You are not "switching to" the root account when you use "sudo." You switch to the root account when you "sudo su."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .