8:55 p.m.
Hi folks,
I've been holding back my tongue on this one, but I've been bitten by it
enough times now that I think I can write something with a clear head. To
put it shortly: disallowing root logins by default is a complete headache
for systems where anything goes wrong. I've run into several different
failure modes now: if / and /tmp get full, it's impossible to login as a
normal user, and if NFS goes down and /home isn't accessible, one cannot login
to fix the problem.
I think the push for never allowing root to login is daft and inconsiderate
of the needs of users who maintain systems. I much prefer the F9 policy of
putting up a warning and allowing me to proceed -- I know it's impossible to
make everything on the desktop root-safe and I don't expect it. The system
should not decree that it knows better than me, though.
-ben
8:59 p.m.
Benjamin LaHaise wrote:
Hi folks,
I've been holding back my tongue on this one, but I've been bitten by it
enough times now that I think I can write something with a clear head. To
put it shortly: disallowing root logins by default is a complete headache
for systems where anything goes wrong. I've run into several different
failure modes now: if / and /tmp get full, it's impossible to login as a
normal user, and if NFS goes down and /home isn't accessible, one cannot login
to fix the problem.
You can at run level 3. You can even start X after that.
Rahul
9:28 p.m.
On Tue, 2009-01-20 at 22:01 -0500, Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
> You can at run level 3. You can even start X after that.
You're assuming all users of a system are technical. That is not the case.
How would a non-technical user know to log in as root?
--
Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>
PLEASE don't CC me; I'm already subscribed
3:55 a.m.
On Tue, 2009-01-20 at 22:28 -0500, Ignacio Vazquez-Abrams wrote:
On Tue, 2009-01-20 at 22:01 -0500, Benjamin LaHaise wrote:
> On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
> > You can at run level 3. You can even start X after that.
>
> You're assuming all users of a system are technical. That is not the case.
How would a non-technical user know to log in as root?
I knew about the root user in *nix long before I knew about run levels
and how to start X manually. It's like the Administrator account in
Windows (at least, that's how most non-techies would understand it).
Besides, some references online will frequently mention logging-in as
root, even if it's not the most advisable. So there are many vectors
through which someone can know about logging in as root without having
the strongest technical background.
________________________________________________________________________
Basil Mohamed Gohar
abu_hurayrah(a)hidayahonline.org
www.basilgohar.com
4 a.m.
Basil Mohamed Gohar wrote:
On Tue, 2009-01-20 at 22:28 -0500, Ignacio Vazquez-Abrams wrote:
> On Tue, 2009-01-20 at 22:01 -0500, Benjamin LaHaise wrote:
> > On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
> > > You can at run level 3. You can even start X after that.
> >
> > You're assuming all users of a system are technical. That is not the case.
>
> How would a non-technical user know to log in as root?
I knew about the root user in *nix long before I knew about run levels
and how to start X manually. It's like the Administrator account in
Windows (at least, that's how most non-techies would understand it).
Besides, some references online will frequently mention logging-in as
root, even if it's not the most advisable. So there are many vectors
through which someone can know about logging in as root without having
the strongest technical background.
Wouldn't it be nice if there were a "launch console window" or "launch
terminal window" option or button on the GDM login screen ? That
certainly would solve the issues of people not familiar with getty
screens and/or runlevels...
4:19 a.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
> You can at run level 3. You can even start X after that.
You're assuming all users of a system are technical. That is not the case.
Non technical users shouldn't be logging in as root and more so X. They
should be either launching graphical programs that ask for a password or
use su - or sudo. It an potentially be made easier by giving them a
"administrator shell" or something like that in the menu which launches
the terminal and asks for a root/sudo password but it would be better to
understand why it is ever needed and solve that issue in a perhaps more
elegant way.
What are the specific use cases, where non technical users are being
compelled to login as root (and other alternatives won't work)?
Rahul
9:18 a.m.
On Wed, Jan 21, 2009 at 4:19 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
What are the specific use cases, where non technical users are being
compelled to login as root (and other alternatives won't work)?
The chief compelling one he mentions seems to be when NFS goes down
and Linux can't find the /home partition.
Or, to put it bluntly, when the Linux distribution isn't smart enough
to protect "non-technical users" (an admittedly subjective term) from
technical problems. Which is often.
But your critique, Mr. Sundaram, doesn't seem to imply that people
shouldn't login as root -- merely that you disagree with allowing them
to open a root session in X. To be rhetorical, we must ask, why?
After all, there's no such thing as "partial root power" -- you either
have full root privileges in a terminal in a normal user X session, or
full root privileges in a root X session.
Here's the why: you feel that a root X session is too insecure --
which it may indeed be. So we believe that the "ideal" method is to
not allow X root logins. But keep in mind, this is not actually an
ideal. It's a kludge to go around the fact that X is designed rather
horribly from a security standpoint. The "user session only" method
allows you to work around that.
But in the above case, user-session-X goes down. You say login at
runlevel 3. But let's face it, many users comfortable with Linux
still aren't at the "I roll my own shell-scripts" stage -- they still
work in GUI mentalities, and odds are, even if they can roll their own
shell-scripts, they won't understand how to fix administrative errors
as well as if they use the actual GUI administrative tools.
For most users, the GUI is critical for maintaining their system. So
it is critical that the GUI be not allowed to fail.
Hence, leave the root-session-X backdoor open, (perhaps with a catch
-- for example, network functionality is disabled in root-session-X --
so that the only possible errors can come from user error, rather than
security vulnerabilities. how about that?) or come up with another
solution. "No GUI" for the sake of safety is a no-go solution for
many people.
10:20 a.m.
On Wed, 2009-01-21 at 09:18 -0600, Jud Craft wrote:
On Wed, Jan 21, 2009 at 4:19 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
Hence, leave the root-session-X backdoor open, (perhaps with a catch
-- for example, network functionality is disabled in root-session-X --
so that the only possible errors can come from user error, rather than
security vulnerabilities. how about that?) or come up with another
solution. "No GUI" for the sake of safety is a no-go solution for
many people.
To login as root on a X session does not only generates security
vulnerabilities, have you thought of people just dragging and
dropping /usr to another location by mistake (I know people that tried),
at least on Windows platforms you get a message about the directory
being used if you try to move/rename C:\windows, and how many of you
have not dragged by mistake a file and dropped it without noticing?
(dumb trackpads, long live trackpoints :-P)
The root console on GDM is a nice idea, but what about adding access to
the GNOME menu System->Administration, use case: I need to add a new
user to the system I only manage without a local user for me, some users
prefer to add the user using the GUI, instead of running adduser
10:29 a.m.
Jud Craft wrote:
Or, to put it bluntly, when the Linux distribution isn't smart enough
to protect "non-technical users" (an admittedly subjective term) from
technical problems. Which is often.
Then let's fix that problem.
But your critique, Mr. Sundaram, doesn't seem to imply that
people
shouldn't login as root -- merely that you disagree with allowing them
to open a root session in X. To be rhetorical, we must ask, why?
After all, there's no such thing as "partial root power" -- you either
have full root privileges in a terminal in a normal user X session, or
full root privileges in a root X session.
There is a big difference in terms of security between a person, login
in as a non-root user and then doing su - compared to a root X session.
Having a root X shell makes it trivial to damage your system
accidentally as well.
Here's the why: you feel that a root X session is too insecure
--
which it may indeed be. So we believe that the "ideal" method is to
not allow X root logins. But keep in mind, this is not actually an
ideal. It's a kludge to go around the fact that X is designed rather
horribly from a security standpoint. The "user session only" method
allows you to work around that.
While moving X out of root is the right decision and work is being done
on that, it is also going to take more time. Meanwhile, it is always
good to run programs with the least amount of privileges possible as a
basic security principle. That isn't a kludge.
But in the above case, user-session-X goes down. You say login at
runlevel 3. But let's face it, many users comfortable with Linux
still aren't at the "I roll my own shell-scripts" stage -- they still
work in GUI mentalities, and odds are, even if they can roll their own
shell-scripts, they won't understand how to fix administrative errors
as well as if they use the actual GUI administrative tools.
If they can't fix it, then they are going to need somebody else to help
it. If you don't know what you are doing, you shouldn't be playing
around in a root shell.
For most users, the GUI is critical for maintaining their system. So
it is critical that the GUI be not allowed to fail.
I am not sure about most but no disagreement on that in principle, we
should take steps to avoid failure.
Hence, leave the root-session-X backdoor open, (perhaps with a catch
-- for example, network functionality is disabled in root-session-X --
so that the only possible errors can come from user error, rather than
security vulnerabilities. how about that?) or come up with another
solution.
That isn't a solution since network capabilities are how you
troubleshoot the problem in my instances.
"No GUI" for the sake of safety is a no-go solution for
many people.
It isn't no GUI however. It is about minimizing the number of programs
running with elevates privileges.
Rahul
7:54 p.m.
Jud Craft wrote:
On Wed, Jan 21, 2009 at 4:19 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
> What are the specific use cases, where non technical users are being
> compelled to login as root (and other alternatives won't work)?
>
The chief compelling one he mentions seems to be when NFS goes down
and Linux can't find the /home partition.
Or, to put it bluntly, when the Linux distribution isn't smart enough
to protect "non-technical users" (an admittedly subjective term) from
technical problems. Which is often.
But your critique, Mr. Sundaram, doesn't seem to imply that people
shouldn't login as root -- merely that you disagree with allowing them
to open a root session in X. To be rhetorical, we must ask, why?
After all, there's no such thing as "partial root power" -- you either
have full root privileges in a terminal in a normal user X session, or
full root privileges in a root X session.
Here's the why: you feel that a root X session is too insecure --
which it may indeed be. So we believe that the "ideal" method is to
not allow X root logins. But keep in mind, this is not actually an
ideal. It's a kludge to go around the fact that X is designed rather
horribly from a security standpoint. The "user session only" method
allows you to work around that.
If I gave you a gun that had an excellent safety mechanism that was
presently activated, would you be willing to play Russian roulette?
The point of having a separate root user is not to trust things. It
doesn't matter how much effort we put into securing them, if they don't
need to run as root, they never should. Gnome-panel doesn't need to ever
run as root.
--CJD
8:18 p.m.
On Wed, Jan 21, 2009 at 7:54 PM, Casey Dahlin wrote:
If I gave you a gun that had an excellent safety mechanism that was
presently activated, would you be willing to play Russian roulette?
Probably not, but conversely, when it comes time to pop a cap in
someone's arse, I want that gun to _work_, darn it.
5:07 a.m.
On 2009-01-21, 15:18 GMT, Jud Craft wrote:
To be rhetorical, we must ask, why?
Don't be rhetorical -- X apps have been written for many years
now with explicit understanding that they will never be run as
root. Firefox is just much more complicated than lynx. If you
don't like it and you trust Firefox more than its developers,
than go ahead and change that pam config.
Matej
9:53 a.m.
On Wed, Jan 21, 2009 at 03:49:09PM +0530, Rahul Sundaram wrote:
Benjamin LaHaise wrote:
>On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
>>You can at run level 3. You can even start X after that.
>
>You're assuming all users of a system are technical. That is not the case.
Non technical users shouldn't be logging in as root and more so X. They
should be either launching graphical programs that ask for a password or
use su - or sudo. It an potentially be made easier by giving them a
"administrator shell" or something like that in the menu which launches
the terminal and asks for a root/sudo password but it would be better to
understand why it is ever needed and solve that issue in a perhaps more
elegant way.
And how do you propose that a user login to fix a problem when they call
tech support saying "I get a blank screen when I login"? I'm curious,
because these are real world cases where the GUI login fails. By disallowing
root logins, there is no way to fix that short of rebooting the system to
even narrow down what the problem is. Even then, with F10 using a 0 second
wait at the grub prompt, it's almost impossible to catch grub in time to
specify the runlevel or init=/bin/sh.
What are the specific use cases, where non technical users are being
compelled to login as root (and other alternatives won't work)?
Systems break, and administrators need to fix them. There are plenty of
non-technical business users who have local technical users who maintain
the systems. Making life harder for these people when systems break is
just plain stupid.
-ben
10:20 a.m.
Benjamin LaHaise wrote:
And how do you propose that a user login to fix a problem when they call
tech support saying "I get a blank screen when I login"? I'm curious,
because these are real world cases where the GUI login fails.
If the GUI login, your fallback is command line, obviously. Having had
support experience for a good number of years, I can tell you that,
instructing people to type some command is far more easier as well.
Rahul
4:51 p.m.
On Wed, 2009-01-21 at 21:50 +0530, Rahul Sundaram wrote:
Benjamin LaHaise wrote:
>
> And how do you propose that a user login to fix a problem when they call
> tech support saying "I get a blank screen when I login"? I'm
curious,
> because these are real world cases where the GUI login fails.
If the GUI login, your fallback is command line, obviously. Having had
support experience for a good number of years, I can tell you that,
instructing people to type some command is far more easier as well.
I don't understand the difference between dropping the user to a
console, and just starting gnome-terminal + metacity when they login as
root on the console.
Or even xterm + twm.
They get the same power to destroy.
disabling root login just seems like the wrong answer, a hack to
workaround the fact that we can't fully enable selinux.
Dave.
4:59 p.m.
Dave Airlie wrote:
disabling root login just seems like the wrong answer, a hack to
workaround the fact that we can't fully enable selinux.
Crippling root with SELinux so it is practically no longer root isn't any
more useful than just disallowing it (they're both bad ideas).
Kevin Kofler
11:49 a.m.
Benjamin LaHaise wrote:
Even then, with F10 using a 0 second
wait at the grub prompt, it's almost impossible to catch grub in time to
specify the runlevel or init=/bin/sh.
No it's not (as I know from personal experience[1]). Start holding F8 as
your BIOS is completing POST. It's not only possible, it's not even
especially hard (the hardest part by far is simply remembering to do it).
[1] https://bugzilla.redhat.com/show_bug.cgi?id=478878
...which, btw, no one seems to be working on. Good to know that Fedora
cares that I can't boot an updated kernel.
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
"Inches: An antiquated measurement unit still in use in certain
backwards countries with incredibly low-cost computer equipment."
-- groff documentation
7:55 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 03:49:09PM +0530, Rahul Sundaram wrote:
> Benjamin LaHaise wrote:
>
>> On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
>>
>>> You can at run level 3. You can even start X after that.
>>>
>> You're assuming all users of a system are technical. That is not the case.
>>
> Non technical users shouldn't be logging in as root and more so X. They
> should be either launching graphical programs that ask for a password or
> use su - or sudo. It an potentially be made easier by giving them a
> "administrator shell" or something like that in the menu which launches
> the terminal and asks for a root/sudo password but it would be better to
> understand why it is ever needed and solve that issue in a perhaps more
> elegant way.
>
And how do you propose that a user login to fix a problem when they call
tech support saying "I get a blank screen when I login"? I'm curious,
because these are real world cases where the GUI login fails. By disallowing
root logins, there is no way to fix that short of rebooting the system to
even narrow down what the problem is. Even then, with F10 using a 0 second
wait at the grub prompt, it's almost impossible to catch grub in time to
specify the runlevel or init=/bin/sh.
Ctrl+Alt+F2
--CJD
8:10 p.m.
On 2009/01/21 20:55 (GMT-0500) Casey Dahlin composed:
> ...Even then, with F10 using a 0 second
> wait at the grub prompt, it's almost impossible to catch grub in time to
> specify the runlevel or init=/bin/sh.
Ctrl+Alt+F2
Not much help when system is configured to start X automatically, and X
proceeds to lock up the whole system because of an Intel video chip's broken
driver.
--
"Train a child in the way he should go, and when he
is old he will not turn from it." Proverbs 22:6 NIV
Team OS/2 ** Reg. Linux User #211409
Felix Miata *** http://fm.no-ip.com/
8:12 p.m.
Felix Miata wrote:
On 2009/01/21 20:55 (GMT-0500) Casey Dahlin composed:
>> ...Even then, with F10 using a 0 second
>> wait at the grub prompt, it's almost impossible to catch grub in time to
>> specify the runlevel or init=/bin/sh.
>>
> Ctrl+Alt+F2
>
Not much help when system is configured to start X automatically, and X
proceeds to lock up the whole system because of an Intel video chip's broken
driver.
And how does allowing graphical root login fix that?
--CJD
8:29 p.m.
On 2009/01/21 21:12 (GMT-0500) Casey Dahlin composed:
Felix Miata wrote:
> On 2009/01/21 20:55 (GMT-0500) Casey Dahlin composed:
>>> ...Even then, with F10 using a 0 second
>>> wait at the grub prompt, it's almost impossible to catch grub in time to
>>> specify the runlevel or init=/bin/sh.
>> Ctrl+Alt+F2
> Not much help when system is configured to start X automatically,
and X
> proceeds to lock up the whole system because of an Intel video chip's broken
> driver.
And how does allowing graphical root login fix that?
It doesn't. It's the reason why nothing graphical should happen before
everything else that graphical requires is known to be functioning, while
typically fixing the broke stuff requires root power.
Graphical boot is obfuscatory nonsense. I just put W2K on an old puter a few
days ago. Linux boots right up, but W2K takes 5 minutes to reach the login
window. The graphical blanket makes it impossible to see what is taking so
bloody long. I know there's a startup option to avoid the graphical doz
curtain, but that should be the default, not a hidden option. Same for Linux:
Graphical should be a selected option for those who want it, not the default.
--
"Train a child in the way he should go, and when he
is old he will not turn from it." Proverbs 22:6 NIV
Team OS/2 ** Reg. Linux User #211409
Felix Miata *** http://fm.no-ip.com/
8:59 p.m.
Felix Miata wrote:
On 2009/01/21 21:12 (GMT-0500) Casey Dahlin composed:
> Felix Miata wrote:
>
>> On 2009/01/21 20:55 (GMT-0500) Casey Dahlin composed:
>>
>>>> ...Even then, with F10 using a 0 second
>>>> wait at the grub prompt, it's almost impossible to catch grub in time
to
>>>> specify the runlevel or init=/bin/sh.
>>>>
>>> Ctrl+Alt+F2
>>>
>> Not much help when system is configured to start X automatically, and X
>> proceeds to lock up the whole system because of an Intel video chip's broken
>> driver.
>>
> And how does allowing graphical root login fix that?
>
It doesn't. It's the reason why nothing graphical should happen before
everything else that graphical requires is known to be functioning, while
typically fixing the broke stuff requires root power.
Graphical boot is obfuscatory nonsense. I just put W2K on an old puter a few
days ago. Linux boots right up, but W2K takes 5 minutes to reach the login
window. The graphical blanket makes it impossible to see what is taking so
bloody long. I know there's a startup option to avoid the graphical doz
curtain, but that should be the default, not a hidden option. Same for Linux:
Graphical should be a selected option for those who want it, not the default.
Defaults exist for people who aren't smart enough to change them.
And graphical boot will go away when Fedora boots in 5 seconds (which it
may do soon).
--CJD
10:38 a.m.
Felix Miata wrote:
Graphical boot is obfuscatory nonsense. I just put W2K on an old
puter a few
days ago. Linux boots right up, but W2K takes 5 minutes to reach the login
window. The graphical blanket makes it impossible to see what is taking so
bloody long. I know there's a startup option to avoid the graphical doz
curtain, but that should be the default, not a hidden option. Same for Linux:
Graphical should be a selected option for those who want it, not the default.
I strongly disagree. Putting all that "junk" (note the quotes, please)
on screen is confusing to people that think a computer should behave
like their microwave and turns people off from using Linux. Joe Average
User doesn't want to see what's going on under the hood, but he does
appreciate pretty graphics. It's a question of target audience.
Besides, unlike 'doze, Fedora gets it right in that hitting ESC makes
the graphics go away and shows you "what's going on under the hood". You
don't need to remember to fiddle with boot options to get it.
IOW, the people that care about watching the verbose boot sequence know
how to configure that. The people that don't know are the same people
that don't want to see what's going on in the first place.
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
Who let the hippos out?
9:26 p.m.
On Wed, Jan 21, 2009 at 10:24:39PM -0500, Casey Dahlin wrote:
Ctrl+Alt+F1 no longer works (or rather, it brings up the X server
instead of Ctrl+Alt+F7). F2-6 should be fine.
No, it does not. If it did, I wouldn't be ranting about the utterly insane
defaults Fedora is deeming essential for all users without care for how it
impacts the *entire* community.
-ben
9:27 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 10:24:39PM -0500, Casey Dahlin wrote:
> Ctrl+Alt+F1 no longer works (or rather, it brings up the X server
> instead of Ctrl+Alt+F7). F2-6 should be fine.
>
No, it does not. If it did, I wouldn't be ranting about the utterly insane
defaults Fedora is deeming essential for all users without care for how it
impacts the *entire* community.
-ben
I maintain the init system. We did not disable these keys. File a bug.
--CJD
9:59 p.m.
Once upon a time, Benjamin LaHaise <bcrl(a)kvack.org> said:
On Wed, Jan 21, 2009 at 10:24:39PM -0500, Casey Dahlin wrote:
> Ctrl+Alt+F1 no longer works (or rather, it brings up the X server
> instead of Ctrl+Alt+F7). F2-6 should be fine.
No, it does not.
Then your system is broken, and it doesn't matter if X is in F7 or F1,
apparently a console switch won't work in any case.
At that point someone that knows how to use root to fix things reboots
into text mode (or even single-user mode).
--
Chris Adams <cmadams(a)hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.
3:44 a.m.
Casey Dahlin píše v St 21. 01. 2009 v 22:24 -0500:
Benjamin LaHaise wrote:
> On Wed, Jan 21, 2009 at 10:22:05PM -0500, Casey Dahlin wrote:
>
>> Uhh..no?
>>
>
> Doesn't work on my F10 box...
>
> -ben
>
Ctrl+Alt+F1 no longer works (or rather, it brings up the X server
instead of Ctrl+Alt+F7). F2-6 should be fine.
If not, file a bug.
The F2-6 are blocked when you have getty running on vt1
(/etc/event.d/tty1 is the same tty[2-6]) and Xorg server runs on vt1 too
(gdm runs with --force-active-vt)
Then there are messages like "unable to switch vt" in /var/log/Xorg.log
Dan
5:31 a.m.
Dan Horák píše v Čt 22. 01. 2009 v 10:44 +0100:
Casey Dahlin píše v St 21. 01. 2009 v 22:24 -0500:
> Benjamin LaHaise wrote:
> > On Wed, Jan 21, 2009 at 10:22:05PM -0500, Casey Dahlin wrote:
> >
> >> Uhh..no?
> >>
> >
> > Doesn't work on my F10 box...
> >
> > -ben
> >
> Ctrl+Alt+F1 no longer works (or rather, it brings up the X server
> instead of Ctrl+Alt+F7). F2-6 should be fine.
>
> If not, file a bug.
The F2-6 are blocked when you have getty running on vt1
(/etc/event.d/tty1 is the same tty[2-6]) and Xorg server runs on vt1 too
(gdm runs with --force-active-vt)
Then there are messages like "unable to switch vt" in /var/log/Xorg.log
The behaviour above requires manual editing of at
least /etc/event.d/tty1, it should not happen in default setups.
Dan
9:42 p.m.
On Wed, 2009-01-21 at 22:19 -0500, Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 08:55:51PM -0500, Casey Dahlin wrote:
> Ctrl+Alt+F2
Gee, that got disabled too.
That would be because your video driver is broken.
--
Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>
PLEASE don't CC me; I'm already subscribed
3:32 a.m.
Le Jeu 22 janvier 2009 04:42, Ignacio Vazquez-Abrams a écrit :
On Wed, 2009-01-21 at 22:19 -0500, Benjamin LaHaise wrote:
> On Wed, Jan 21, 2009 at 08:55:51PM -0500, Casey Dahlin wrote:
> > Ctrl+Alt+F2
>
> Gee, that got disabled too.
That would be because your video driver is broken.
Or if the system was upgraded and some xfree86 => xorg or kbd => evdev
input migration went wrong. One of the symptoms can be dead CTRL in X.
--
Nicolas Mailhot
4:58 a.m.
On 2009-01-21, 15:53 GMT, Benjamin LaHaise wrote:
Even then, with F10 using a 0 second wait at the grub prompt,
it's almost impossible to catch grub in time to specify the
runlevel or init=/bin/sh.
OK, is THIS the problem? Then don't babble about disallowing root
login (which is nonsense and your repeating won't make it true
ever). I don't like this default either, but pressing 'a'
repeatedly will get you to the kernel command prompt. And the
problem is not 0 timeout (there is 5 IIRC), but the 'hiddenmenu'
option which makes grub menu invisible.
Matej
5:19 a.m.
Matej Cepl wrote:
On 2009-01-21, 15:53 GMT, Benjamin LaHaise wrote:
> Even then, with F10 using a 0 second wait at the grub prompt,
> it's almost impossible to catch grub in time to specify the
> runlevel or init=/bin/sh.
OK, is THIS the problem? Then don't babble about disallowing root
login (which is nonsense and your repeating won't make it true
ever). I don't like this default either, but pressing 'a'
repeatedly will get you to the kernel command prompt. And the
problem is not 0 timeout (there is 5 IIRC), but the 'hiddenmenu'
option which makes grub menu invisible.
I didn't know that pressing 'a' repeatedly will get you to the kernel
command prompt. The problem with a lot of these changes is that they
break techniques that people have used for many years. And if you don't
know that the pressing 'a' trick exists, you don't know how to ask
how to do it -- especially if your computer doesn't boot.
Andrew.
6:03 a.m.
On 2009-01-22, 11:19 GMT, Andrew Haley wrote:
I didn't know that pressing 'a' repeatedly will get you
to the
kernel command prompt.
Well, strictly speaking you can press any key (I think even Ctrl
will do), but advantage of 'a' is that it gets you straight to
kernel command line ('a' command in grub).
Matej
10:44 a.m.
Matej Cepl wrote:
On 2009-01-22, 11:19 GMT, Andrew Haley wrote:
> I didn't know that pressing 'a' repeatedly will get you to the
> kernel command prompt.
Well, strictly speaking you can press any key (I think even Ctrl
will do), but advantage of 'a' is that it gets you straight to
kernel command line ('a' command in grub).
You mean it isn't supposed to be F8? :-) Wonder where I got that idea
from, then.
You don't have to "press repeatedly" either, just start holding
something as the BIOS is finishing with POST.
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
Who let the hippos out?
10:54 a.m.
On Thu, 2009-01-22 at 10:44 -0600, Matthew Woehlke wrote:
You mean it isn't supposed to be F8? :-) Wonder where I got that
idea
from, then.
It's any key.
You don't have to "press repeatedly" either, just start holding
something as the BIOS is finishing with POST.
Right, so long as your bios doesn't freak out about a stuck key.
Typically I use shift as it doesn't have any bios level bindings, nor
any grub level bindings. You can just lay on the shift and grub will
eventually bring up a gui for you.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
7:49 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 08:29:33AM +0530, Rahul Sundaram wrote:
> You can at run level 3. You can even start X after that.
>
You're assuming all users of a system are technical. That is not the case.
-ben
Then they don't need root.
Is it wrong that I actually /miss/ the linux community's sense of
elitism? It kept us so much more sensible on so many things.
--CJD
9:22 p.m.
On Wed, Jan 21, 2009 at 08:49:54PM -0500, Casey Dahlin wrote:
Then they don't need root.
Is it wrong that I actually /miss/ the linux community's sense of
elitism? It kept us so much more sensible on so many things.
If systems didn't break we wouldn't need root, sure. But back here in
reality, things aren't there yet. Disallowing root logins merely makes
life hard for those of us trying to fix broken systems.
-ben
9:23 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 08:49:54PM -0500, Casey Dahlin wrote:
> Then they don't need root.
>
> Is it wrong that I actually /miss/ the linux community's sense of
> elitism? It kept us so much more sensible on so many things.
>
If systems didn't break we wouldn't need root, sure. But back here in
reality, things aren't there yet. Disallowing root logins merely makes
life hard for those of us trying to fix broken systems.
-ben
If you aren't technical, how will you fix your own system?
--CJD
9:27 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 10:23:46PM -0500, Casey Dahlin wrote:
> If you aren't technical, how will you fix your own system?
>
By calling tech support or asking a technical user to help. This isn't
rocket science, but you're trying to make it as hard as possible.
-ben
And won't tech support know how to get root?
--CJD
9:29 p.m.
On Wed, Jan 21, 2009 at 10:27:17PM -0500, Casey Dahlin wrote:
And won't tech support know how to get root?
Exactly, they won't be able to.
This cavalier to-hell-with-the-users attitude seems to get worse with every
release. It doesn't seem to matter how much effort is put into fighting the
bad user attitude of people like you. It's like zombies -- they're dead but
keep trying to eat you.
-ben
9:38 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 10:27:17PM -0500, Casey Dahlin wrote:
> And won't tech support know how to get root?
>
Exactly, they won't be able to.
This cavalier to-hell-with-the-users attitude seems to get worse with every
release. It doesn't seem to matter how much effort is put into fighting the
bad user attitude of people like you. It's like zombies -- they're dead but
keep trying to eat you.
-ben
You can get root on a Fedora box. Easily. The reason for my attitude is
confirmed. You clearly have /no idea what you're talking about/.
I've asked you twice now to file a bug against a legitimate problem. If
you can't get a TTY on your box with Ctrl+Alt+F2 your install is broken.
--CJD
9:45 p.m.
On Wed, Jan 21, 2009 at 10:38:53PM -0500, Casey Dahlin wrote:
You can get root on a Fedora box. Easily. The reason for my attitude
is
confirmed. You clearly have /no idea what you're talking about/.
Please enlighten me how one gets root on a system where you can't get to a
login prompt, and where logging in as a regular user fails?
I've asked you twice now to file a bug against a legitimate
problem. If
you can't get a TTY on your box with Ctrl+Alt+F2 your install is broken.
I've given up filing bugs on anything gnome or X related in the Fedora
bugzilla, as they get closed when a release goes EOL without being fixed.
Please prove me wrong this time.
-ben
9:48 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 10:38:53PM -0500, Casey Dahlin wrote:
> You can get root on a Fedora box. Easily. The reason for my attitude is
> confirmed. You clearly have /no idea what you're talking about/.
>
Please enlighten me how one gets root on a system where you can't get to a
login prompt, and where logging in as a regular user fails?
> I've asked you twice now to file a bug against a legitimate problem. If
> you can't get a TTY on your box with Ctrl+Alt+F2 your install is broken.
>
I've given up filing bugs on anything gnome or X related in the Fedora
bugzilla, as they get closed when a release goes EOL without being fixed.
Please prove me wrong this time.
-ben
I'll need to see the problem first, and all my F10 boxes are working in
this regard.
--CJD
1:24 a.m.
Casey Dahlin wrote:
Benjamin LaHaise wrote:
> On Wed, Jan 21, 2009 at 10:38:53PM -0500, Casey Dahlin wrote:
>
>> You can get root on a Fedora box. Easily. The reason for my attitude
>> is confirmed. You clearly have /no idea what you're talking about/.
>>
>
> Please enlighten me how one gets root on a system where you can't get
> to a login prompt, and where logging in as a regular user fails?
>
>
>> I've asked you twice now to file a bug against a legitimate problem.
>> If you can't get a TTY on your box with Ctrl+Alt+F2 your install is
>> broken.
>>
>
> I've given up filing bugs on anything gnome or X related in the Fedora
> bugzilla, as they get closed when a release goes EOL without being
> fixed. Please prove me wrong this time.
>
> -ben
>
I'll need to see the problem first, and all my F10 boxes are working in
this regard.
I've seen boxes where you cannot login any more because of LDAP and/or
Kerberos Auth not working (for whatever reasons).
That's true for >root< account as well - even if the nsswitch.conf is
*correct*.
However. Single User mode always helped and your Tech support will know
how to get into init 1. I hope. If not, you should find another Tech
Support :-P
Regarding your (Ctrl-)Alt-F2 Problem. I've never seen this. In no
release. Well, something similar on a Desktop Box, where you try to
switch from X to text console and the system freezes -> This was some
nvid** driver bug. Already fixed with latest drivers of course.
Still. Single User mode is an option that *always* worked since I know
UN*X/Linux and all their flavours :-)
-of
1:43 a.m.
On 01/22/2009 10:24 AM, Oliver Falk wrote:
>>> I've asked you twice now to file a bug against a
legitimate problem.
>>> If you can't get a TTY on your box with Ctrl+Alt+F2 your install is
>>> broken.
>>>
>>
>> I've given up filing bugs on anything gnome or X related in the
>> Fedora bugzilla, as they get closed when a release goes EOL without
>> being fixed. Please prove me wrong this time.
>>
>> -ben
>>
> I'll need to see the problem first, and all my F10 boxes are working
> in this regard.
Regarding your (Ctrl-)Alt-F2 Problem. I've never seen this. In no
release. Well, something similar on a Desktop Box, where you try to
switch from X to text console and the system freezes -> This was some
nvid** driver bug. Already fixed with latest drivers of course.
I've seen broken Ctrl-Alt-F2 problem on the box I'm using right now to write
this mail. However this problem is not persistent and I yet haven't found a
reliable way to reproduce it. On the GDM screen and right after logging in
switching works fine, but some time later it does brake. If I find how to
reproduce this I will file a bug.
--
Lev.
4:51 a.m.
On 2009-01-22, 07:43 GMT, Lev Shamardin wrote:
I've seen broken Ctrl-Alt-F2 problem on the box I'm using
right
now to write this mail.
Yes, there are bugs like that with some drivers -- we are working
on it as much as we can, but there is certainly not policy about
non-X root login, and we are dancing as fast as we can to fix it.
Matej
6:37 a.m.
On Thursday 22 January 2009 07:24:38 Oliver Falk wrote:
Regarding your (Ctrl-)Alt-F2 Problem. I've never seen this. In
no
release. Well, something similar on a Desktop Box, where you try to
switch from X to text console and the system freezes -> This was some
nvid** driver bug. Already fixed with latest drivers of course.
Or trying to boot F10 on my desktop machine here at work, and run X.
Seriously, things do sometimes go wrong, and when they do, it helps no one to
go "oh, well, it works on my machine so you must be wrong". It doesn't
always
involve the nVidia drivers.
9:48 a.m.
On 2009-01-22, 12:37 GMT, Bill Crawford wrote:
Seriously, things do sometimes go wrong, and when they do, it
helps no one to go "oh, well, it works on my machine so you
must be wrong". It doesn't always involve the nVidia drivers.
I have never said we don't have bugs breaking access to VT[2-*],
but it seemed to me that this thread was originally about POLICY
-- "OMG, Fedora disallowed root access!!!" or crap like this.
Matěj
4:50 a.m.
On 2009-01-22, 03:45 GMT, Benjamin LaHaise wrote:
I've given up filing bugs on anything gnome or X related in the
Fedora bugzilla, as they get closed when a release goes EOL
without being fixed. Please prove me wrong this time.
Prove yourself wrong yourself -- what happens when you do
Ctrl+Alt+F2 in X?
Matej
7:17 p.m.
On Thu, Jan 22, 2009 at 11:50:16AM +0100, Matej Cepl wrote:
Prove yourself wrong yourself -- what happens when you do
Ctrl+Alt+F2 in X?
I've known about this trick for more than a decade, and when I try to switch
to any text console on my F10 installs, nothing occurs -- the system remains
in X. The combination of that with no more root logins (which I'm vehemently
opposed to as I think this nannying of experienced users is against the whole
Linux experience) and changes to the grub config that make the window to
catch the boot loader much narrower, my overall impression of Fedora 10 as a
long time Linux user is very negative. Firefox keeps losing my bookmarks
(yes, there's a bug filed for that with mozilla), arrow keys don't work
correctly in qemu or vmware, metacity crashes on startup 1 in 5 logins,
suspend doesn't work despite the next generation suspend code being used
in other distributions that do work, and all my systems have had their nfs
mounts denied due to another overzealous "security improvement"...
Sure, some of these are simple bugs, but the one that drives me nuts is the
system denying me the ability to fix it. The security concerns are
unreasonable given that Fedora 9 popped up a dialog warning a user when
logging in as root. This is a step backwards in usability, not an improvement.
-ben
9:12 p.m.
Benjamin LaHaise wrote:
On Thu, Jan 22, 2009 at 11:50:16AM +0100, Matej Cepl wrote:
> Prove yourself wrong yourself -- what happens when you do
> Ctrl+Alt+F2 in X?
I've known about this trick for more than a decade, and when I
try to switch
to any text console on my F10 installs, nothing occurs -- the system remains
in X. The combination of that with no more root logins (which I'm vehemently
opposed to as I think this nannying of experienced users is against the whole
Linux experience) and changes to the grub config that make the window to
catch the boot loader much narrower, my overall impression of Fedora 10 as a
long time Linux user is very negative. Firefox keeps losing my bookmarks
(yes, there's a bug filed for that with mozilla), arrow keys don't work
correctly in qemu or vmware, metacity crashes on startup 1 in 5 logins,
suspend doesn't work despite the next generation suspend code being used
in other distributions that do work, and all my systems have had their nfs
mounts denied due to another overzealous "security improvement"...
Sure, some of these are simple bugs, but the one that drives me nuts
is the
system denying me the ability to fix it. The security concerns are
unreasonable given that Fedora 9 popped up a dialog warning a user when
logging in as root. This is a step backwards in usability, not an improvement.
-ben
First... I apologize. I don't really relong here. I am not a sys admin,
a developer, nothing special. I am just a long time, ordinary,
interested Linux user. Period. No training. No schooling. Other than my
at home, 'hands on' experience, self taught knowledge.
*I* know how to cold boot to a CLI bootup. *I* know how to boot to a
level 1 emergency (rescue) boot. *I* know how to get out of a user level
5 GUI and drop to a CLI level 3. *I* know how to start a 'root session'
GUI from the level 3 CLI as well as work from the CLI. I know what, and
how, to edit what it takes to permit a GUI root login from the DM. All
with todays Fedora, and other distro's, releases offered.
So the *real* complaint is what here is what? Really? That a stupid ole'
user like me knows how to do what the self proclaimed 'super experts'
don't know how to do? Get real.
So change this to suit your needs and wants. Or, please. Shut the hell
up about this already.
<sigh>
--
David
12:11 p.m.
Benjamin LaHaise wrote:
arrow keys don't work correctly in qemu or vmware,
I don't know about vmware, for qemu this may be a bug related to the
switch to evdev. My keyboard problems (far more than arrow keys weren't
working!) was fixed by specifying the keyboard type when starting quemu,
e.g. 'qemu-<flavor> -k en-us ...'.
--
Matthew
Please do not quote my e-mail address unobfuscated in message bodies.
--
|-\ /-\ \ | -+- |-\ + \ | -+- /-\
| | | | |\| | |-/ /-\ |\| | |
|-/ \-/ | \ | | | | | \ -+- \-
9:41 p.m.
Benjamin LaHaise wrote:
On Wed, Jan 21, 2009 at 10:27:17PM -0500, Casey Dahlin wrote:
> And won't tech support know how to get root?
Exactly, they won't be able to.
Sure they will. They just won't be doing it via a GUI, unless they
first change the default in the gdm pam config -- which is trivial for
someone that is capable of fixing your linux system. Even more likely
is that they won't see any reason to login to a full desktop session
as root to perform such maintenance.
"Relax. Have a homebrew." :-)
--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It is OK to let your mind go blank, but please turn off the sound.
8:47 a.m.
Casey Dahlin wrote:
Is it wrong that I actually /miss/ the linux community's sense
of
elitism? It kept us so much more sensible on so many things.
It's my sense of elitism that makes me irritated when y'all try to
protect me from myself. ;-)
--
========================================================================
Ian Pilcher arequipeno(a)gmail.com
========================================================================
1:36 a.m.
On Wed, 21 Jan 2009, Rahul Sundaram wrote:
You can at run level 3. You can even start X after that.
Haha, if the machine is a few hundred miles away at the customer and you
don't have any longer access? Ever tried to explain a non-computer user
being near to the machine how to solve issues via phone if it's urgent or
even critical and time to drive the few hundred miles is not available,
too? Very clever suggestion, you've made...
Greetings,
Robert
2:01 a.m.
Robert Scheck wrote:
On Wed, 21 Jan 2009, Rahul Sundaram wrote:
> You can at run level 3. You can even start X after that.
Haha, if the machine is a few hundred miles away at the customer and you
don't have any longer access? Ever tried to explain a non-computer user
being near to the machine how to solve issues via phone if it's urgent or
even critical and time to drive the few hundred miles is not available,
too? Very clever suggestion, you've made...
Yes. I have. For a few years actually and in my experience, it has
always been more efficient to instruct people type things in the
terminal rather than login via GDM as root user. For one, the shell is
pretty consistent, commands don't change often if at all and for
administration, you frequently have to fall back to the terminal anyway.
Never once have I felt a real need to tell people to get a root X login
for any reason at all.
Rahul
6:14 a.m.
On Thu, 22 Jan 2009, Rahul Sundaram wrote:
Never once have I felt a real need to tell people to get a root X
login
for any reason at all.
I'm always suggesting using a terminal rather a whole X login, but we don't
life in a perfect world. We just have the reality being not perfect - so we
have to deal with such things as well.
Greetings,
Robert
12:08 p.m.
Robert Scheck wrote:
On Thu, 22 Jan 2009, Rahul Sundaram wrote:
> Never once have I felt a real need to tell people to get a root X login
> for any reason at all.
I'm always suggesting using a terminal rather a whole X login, but we don't
life in a perfect world. We just have the reality being not perfect - so we
have to deal with such things as well.
This is a argument for always retaining the status quo no matter what. I
don't buy it. If you are encouraging using a terminal rather than a root
X login, then you should be supporting the current default. Those who
know, what they are doing can edit the pam configuration anyway.
Rahul
1:01 p.m.
On Thu, Jan 22, 2009 at 3:01 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
Never once have I felt a real need to tell people to get a root X
login for
any reason at all.
What if /home is hosed and they need the network (WIFI) to fix it?
How would you get NetworkManager configured from the command line?
How would I get that new kernel that resolves the problem?
What if /home is hosed, or / and /tmp are full, and system-config-lvm
is needed to help fix it? Or any one of the other splendid GUIs we
now have that are an awful lot less error prone than doing something
from the command line.
Note that I'm not necessarily in favour of allowing root logins on X
*by default*, its just that I don't like the argument of "I have
never..." being falsely extrapolated to "Nobody will ever ..."
1:21 p.m.
On Thu, 2009-01-22 at 14:01 -0500, Andrew Parker wrote:
On Thu, Jan 22, 2009 at 3:01 AM, Rahul Sundaram
<sundaram(a)fedoraproject.org> wrote:
> Never once have I felt a real need to tell people to get a root X login for
> any reason at all.
What if /home is hosed and they need the network (WIFI) to fix it?
How would you get NetworkManager configured from the command line?
How would I get that new kernel that resolves the problem?
What if /home is hosed, or / and /tmp are full, and system-config-lvm
is needed to help fix it? Or any one of the other splendid GUIs we
now have that are an awful lot less error prone than doing something
from the command line.
Note that I'm not necessarily in favour of allowing root logins on X
*by default*, its just that I don't like the argument of "I have
never..." being falsely extrapolated to "Nobody will ever ..."
So create a user with a homedir of /tmp or some rot, that isn't on your
network mounted /home that you can use for maint tasks. IE a completely
local user to use for recovery purposes.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
midnight
Jesse Keating wrote:
On Thu, 2009-01-22 at 14:01 -0500, Andrew Parker wrote:
> On Thu, Jan 22, 2009 at 3:01 AM, Rahul Sundaram
> <sundaram(a)fedoraproject.org> wrote:
>
>
>> Never once have I felt a real need to tell people to get a root X login for
>> any reason at all.
>>
> What if /home is hosed and they need the network (WIFI) to fix it?
> How would you get NetworkManager configured from the command line?
> How would I get that new kernel that resolves the problem?
>
> What if /home is hosed, or / and /tmp are full, and system-config-lvm
> is needed to help fix it? Or any one of the other splendid GUIs we
> now have that are an awful lot less error prone than doing something
> from the command line.
>
> Note that I'm not necessarily in favour of allowing root logins on X
> *by default*, its just that I don't like the argument of "I have
> never..." being falsely extrapolated to "Nobody will ever ..."
>
So create a user with a homedir of /tmp or some rot, that isn't on your
network mounted /home that you can use for maint tasks. IE a completely
local user to use for recovery purposes.
More to the point, NetworkManager should be a lot easier to use from the
command line. Thank you for your suggestion, we are working on it.
And the guis are less error prone? I've always found most of
system-config-* to be a ghetto.
--CJD
3:39 a.m.
Benjamin LaHaise wrote:
I think the push for never allowing root to login is daft and
inconsiderate of the needs of users who maintain systems. I much prefer
the F9 policy of putting up a warning and allowing me to proceed -- I know
it's impossible to make everything on the desktop root-safe and I don't
expect it. The system should not decree that it knows better than me,
though.
Remove the offending line from your /etc/pam.d/gdm file.
And yes, I also think that default setting sucks (and FWIW, KDM currently
isn't set up that way).
Kevin Kofler
7:05 a.m.
On Tue, Jan 20, 2009 at 9:55 PM, Benjamin LaHaise <bcrl(a)kvack.org> wrote:
if / and /tmp get full, it's impossible to login as a
normal user,
This is the real bug. What we need is a system that detects this
condition very early on login and initiates a program to help you
clean things up.
7:20 a.m.
Am Dienstag, den 20.01.2009, 21:55 -0500 schrieb Benjamin LaHaise:
I think the push for never allowing root to login is daft and inconsiderate
of the needs of users who maintain systems.
I don't think so, but if you _really_ want to enable root login in gdm,
edit /etc/pam.d/gdm comment out the line reading
auth required pam_succeed_if.so user != root quiet
Simple as that.
Regards,
Christoph
5597
days inactive
5599
days old
75 comments
29 participants
participants (29)
-
Andrew Haley -
Andrew Parker -
Basil Mohamed Gohar -
Benjamin LaHaise -
Bill Crawford -
Casey Dahlin -
Chris Adams -
Christoph Wickert -
Colin Walters -
Dan Horák -
David Airlie -
David Boles -
Denis Leroy -
Felix Miata -
Ian Pilcher -
Ignacio Vazquez-Abrams -
Jesse Keating -
Jud Craft -
Kevin Kofler -
Lev Shamardin -
Matej Cepl -
Matthew Woehlke -
Nicolas Mailhot -
Oliver Falk -
Rahul Sundaram -
Ralf Ertzinger -
Robert Marcano -
Robert Scheck -
Todd Zullinger