3

I found the following general advice from WikiHow in an article on changing password:

It is very dangerous to stay logged in as root for an extended period of time. Log out immediately after completing this process.

If I have to perform a number of administrative tasks requiring root access, is it safer to log in as a normal user and use sudo for every command instead of logging in as root to complete all the tasks in one shot?

How would prolonging the root access be a security risk in itself?

4 Answers 4

3

In fact is it not inherently dangerous to stay logged in as root; what is dangerous is leaving the room with a root shell open, because any casual attacker could then do quite some damage (he could do it nonetheless, because physical access is physical access, but with an open root shell it is much easier and faster).

sudo, on the other hand, as an inherent timeout: it will require that you enter your password again if you have not executed it for a few minutes. This feature is like the "automatic screensaver lock" for root command lines, that a root shell does not have. It is a protection against your own distraction.

Of course, the same attacker could use an open shell at your name to install a fake "sudo" command, which calls the real one but also sends him a copy of your password, so leaving open shells around is a bad idea anyway, root or not root. Also, some people add "NOPASSWD:" to their entry in /etc/sudoers (I have done so myself quite a few times). The ban on root shells has become a widespread dogma, that people parrot mindlessly without thinking about the why.

11
  • 1
    So, what about tty hijacking? Don't you consider that a real threat?
    – kiBytes
    Jan 20, 2014 at 12:56
  • 2
    Not really. I mean, a bug is a bug. There was a bug allowing tty hijacking, but that's only one among many locally exploitable bugs which could lead to privilege escalation, were discovered, and fixed. It would be overoptimistic to believe that not maintaining a root tty open substantially improves the situation, especially since the tty code has been reviewed (because of the previous bug). Jan 20, 2014 at 13:53
  • Also, privilege escalation is a threat in contexts where attackers can run their own code on the machine as an unprivileged user. This is the "mainframe model". Not many Linux system out there still follow that model; a lot of machines, in particular desktop systems and laptops, are mono-user and the protection layer between root and non-root becomes irrelevant. Jan 20, 2014 at 13:54
  • Well, the first problem with the TTY hijacking was some years ago (90's), but then we found it again in the 00, and we have faced it again in 2013 (at least). I usually follow the "don't overkill" rule, but in the cases where only changing an habit may bring clear benefits with cost 0 I usually consider adding it as a easy policy to follow. I think that the case of this issue about "using root" is something people tend to minimize and think that "this is a remain from the past", but it is not. (I will elaborate in the next comment).
    – kiBytes
    Jan 20, 2014 at 14:35
  • Working as root is something we fought against in the past because it is only harmful. If you want to leave behind the actual threats (as the TTY hijacking), consider what will go after working with root. As most people consider administering the machines with long root sessions, the people will begin to think, then, "why can't I log-in directly as a root to maintain? after all, ssh is encrypted." You will slowly down play the importance of the root user and you will bring up old threats.
    – kiBytes
    Jan 20, 2014 at 14:40
2

Because as long as you're logged in as root, your chances of making the kind of mistake that leaves you praying your backups are recent are significantly elevated.

Think of it as leaving a loaded, chambered gun out on the table even while you're just busy reading the newspaper.

Sure, it's not likely that someone will barge in, grab it and shoot you, and it's also not likely that you'll reach for your coffee without looking and accidentally wind up grabbing the trigger.

But only an idiot would take the risk unless they're in circumstances where a dire threat can occur without sufficient warning and the two seconds they'd need to draw, chamber and shoot might mean the difference between life and death.

Not leaving a root terminal open when you're not actively using one is basic responsible systems in the same way that clearing the chamber of a gun and engaging the safety is basic responsible gun ownership.

7
  • 1
    +1 for translating dangerous onto operational security Jan 20, 2014 at 16:53
  • Might I ask why the -1? Jan 20, 2014 at 22:38
  • 1
    I think the analogy does not really fit the situation. I would liken the role of a system administrator as someone holding a rifle in a battlefield. Every now and then, an enemy would pop up. Do you put to safe after killing each enemy and switch back to fire when you are just about to fire the next round or would you keep the weapon ready to fire at all times? Jan 21, 2014 at 2:27
  • @QuestionOverflow, That's not enough reason for a -1....
    – Pacerier
    May 22, 2015 at 11:01
  • @Pacerier, that wasn't from me. Jun 10, 2015 at 15:12
0

If you keep a root tty opened, this tty could be theoretically hijacked from someone in the same machine.

This is an old issue with old kernels and you shouldn't be able to achieve this without a root account anymore, but a bug could emerge any day and you will be exposed as you usually have long root sessions. Look at these bugs:

Apart from this, there are other considerations like, the longer you are root in a console the more chances you have to make an error. Or to leave your desktop unlocked and someone typing in the tty as root, etc.

This is definitely a bad practice.

4
  • Even if you keep it open for a short time, the hijacker can patiently wait for the next time you use one. Jan 20, 2014 at 12:33
  • That is completely right, but you minimize the risk and the window of opportunity. If you build your script and launch it via "sudo" you will only have this windows meanwhile the command is being executed. Also you can log the exact user that launched that command =)
    – kiBytes
    Jan 20, 2014 at 12:37
  • @kiBytes, I think Thomas brought up a valid point regarding the security context. If the server is not operating in the old mainframe model but the contemporary client-server model, then the premise of such TTY hijacking does not really exist. Jan 21, 2014 at 2:54
  • @QuestionOverflow I am not agree with you guys, but it is fine as long as you have considered the risk of doing so.
    – kiBytes
    Jan 21, 2014 at 6:38
0

If you think back to how it was in Windows 95/98, everyone was system administrators. Do we agree that this was a bad thing?

There are nothing that is inherently wrong with keeping a root shell open (i.e. detach a root shell using the "screen" tool). What can be a bad practice, is to do everything as a root user. Instead of running exactly what you require as super-user, with the "sudo" utility, you more or less go back to how it was in 1995.

  1. What could be a simple coding error, could now erase your whole filesystem
  2. Simple mistakes can now have large consequences.
  3. Vulnerabilities that would only lead to a compromised user account, now leads to a systemwide compromise.
1
  • I disagree completely. There exist true risks by being root for long periods. This is not a convention any more and this is not an issue about launching misstyped root commands (you could exactly misstype a command including the word "sudo"). The real problem here is establishing a risky work environment causing other workflow vulnerabilities by working with root.
    – kiBytes
    Jan 20, 2014 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .