On Thu, Apr 15, 2010 at 7:21 AM, hewjr1000@gmail.com wrote:
How do I make myself root in the GUI
Running a root GUI login is very much frowned upon. What exactly are you trying to accomplish? The system-config* tools will prompt for root authentication if necessary or you can su (or sudo) to root in a terminal session or login as root in a virtual terminal.
Richard
On Thu, 15 Apr 2010 07:24:32 -0500 Richard Shaw wrote:
The system-config* tools will prompt for root authentication if necessary
Thousands and thousands of times in a row, in fact :-).
I'm still waiting for someone to point me to the web page documenting the actual case histories of horrible things that happened because a GUI app was running as root. (NOT the cases where people did stupid things in GUIs, I want the one that describes people doing perfectly normal safe operations who had horrible things go wrong simply because they were running a gui as root).
On Thu, 2010-04-15 at 08:32 -0400, Tom Horsley wrote:
On Thu, 15 Apr 2010 07:24:32 -0500 Richard Shaw wrote:
The system-config* tools will prompt for root authentication if necessary
Thousands and thousands of times in a row, in fact :-).
I'm still waiting for someone to point me to the web page documenting the actual case histories of horrible things that happened because a GUI app was running as root. (NOT the cases where people did stupid things in GUIs, I want the one that describes people doing perfectly normal safe operations who had horrible things go wrong simply because they were running a gui as root).
You mean the cases where everything works correctly? If everything worked correctly and there were no bugs, and our systems weren't Internet-connected, and we understood the implications of everything we did, and we never typed or clicked on anything we didn't mean to, why would we need the concept of root?
poc
On Thu, 2010-04-15 at 07:24 -0500, Richard Shaw wrote:
On Thu, Apr 15, 2010 at 7:21 AM, hewjr1000@gmail.com wrote:
How do I make myself root in the GUI
Running a root GUI login is very much frowned upon. What exactly are you trying to accomplish? The system-config* tools will prompt for root authentication if necessary or you can su (or sudo) to root in a terminal session or login as root in a virtual terminal.
Richard
I suspect that he wants to execute a privileged operation from the GUI, not that he wants to run the GUI from root, though the question is unclear.
poc
On 04/15/2010 08:24 AM, Richard Shaw wrote:
On Thu, Apr 15, 2010 at 7:21 AM,hewjr1000@gmail.com wrote:
How do I make myself root in the GUI
Running a root GUI login is very much frowned upon. What exactly are you trying to accomplish? The system-config* tools will prompt for root authentication if necessary or you can su (or sudo) to root in a terminal session or login as root in a virtual terminal.
One scenario is when the normal users are all defined over nis/nfs, and the network is down, but you need to log in to fix things...
To fix things in a scenario like that, I boot into runlevel 3 (by temporarily appending "3" to the end of the kernel line in grub), login as root, and run "startx" to get a gui session for root.
- Mike
On Thu, 15 Apr 2010 08:14:30 -0430 Patrick O'Callaghan wrote:
and we never typed or clicked on anything we didn't mean to
Right. You can type things you don't mean to as easily as click things you don't mean to. I'm just looking for the actual evidence that GUIs are fundamentally evil when running as root, not all this vague handwaving "Oh, it must be horrible!" stuff that seems to be entirely anecdotal or possibly completely imaginary.
P.S. The simplest way to login to the gui as root is to switch to KDM instead of GDM as your login manager. KDM has not yet been taken over by the paranoid thought police :-).
Richard Shaw:
The system-config* tools will prompt for root authentication if necessary
Tom Horsley:
Thousands and thousands of times in a row, in fact :-).
Not here. Once you've authenticated, that info is cached for a few minutes, and automatically renewed as you keep on doing things as root. And, if you are going to be idle for a while, you can manually extend the period without having to type in the password again (there's an icon in the task bar where you can renew/release it).
I'm still waiting for someone to point me to the web page documenting the actual case histories of horrible things that happened because a GUI app was running as root. (NOT the cases where people did stupid things in GUIs, I want the one that describes people doing perfectly normal safe operations who had horrible things go wrong simply because they were running a gui as root).
Yeah, well, the *usual* thing that cause problems is - the user stays logged in as root, does all their work as root, all *their* files are owned by root, so they have to keep on logging in as root to use their files. They paint themselves into a corner, then use that to justify why they "need" to be root.
If you want further ideas about what goes wrong, go back through the list and look at some of Gene's posts. He runs as root, and comes a cropper over it, often enough.
Traditionally IRC (as root) users have their problems, it's just making it easy for them to become a zombie.
two questions....
can you point to articles where a user as root was using an IRC client and got zombified??
and 2, are you guys saying that gnome in fedora 11/12 doesn't allow a user to log in as the root user?
thanks
On Thu, Apr 15, 2010 at 6:40 AM, Tim ignored_mailbox@yahoo.com.au wrote:
Richard Shaw:
The system-config* tools will prompt for root authentication if necessary
Tom Horsley:
Thousands and thousands of times in a row, in fact :-).
Not here. Once you've authenticated, that info is cached for a few minutes, and automatically renewed as you keep on doing things as root. And, if you are going to be idle for a while, you can manually extend the period without having to type in the password again (there's an icon in the task bar where you can renew/release it).
I'm still waiting for someone to point me to the web page documenting the actual case histories of horrible things that happened because a GUI app was running as root. (NOT the cases where people did stupid things in GUIs, I want the one that describes people doing perfectly normal safe operations who had horrible things go wrong simply because they were running a gui as root).
Yeah, well, the *usual* thing that cause problems is - the user stays logged in as root, does all their work as root, all *their* files are owned by root, so they have to keep on logging in as root to use their files. They paint themselves into a corner, then use that to justify why they "need" to be root.
If you want further ideas about what goes wrong, go back through the list and look at some of Gene's posts. He runs as root, and comes a cropper over it, often enough.
Traditionally IRC (as root) users have their problems, it's just making it easy for them to become a zombie.
-- [tim@localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
On Thu, 15 Apr 2010 06:49:08 -0700 bruce wrote:
and 2, are you guys saying that gnome in fedora 11/12 doesn't allow a user to log in as the root user?
The GDM program doesn't allow you to login as root (though you can edit some obscure files to change that). A gnome session is willing to run as root if you can get past the login hurdles :-).
在 2010-04-15四的 10:13 -0400，Tom Horsley写道：
On Thu, 15 Apr 2010 06:49:08 -0700 bruce wrote:
and 2, are you guys saying that gnome in fedora 11/12 doesn't allow a user to log in as the root user?
The GDM program doesn't allow you to login as root (though you can edit some obscure files to change that). A gnome session is willing to run as root if you can get past the login hurdles :-).
edit /etc/passwd modify your uid and gid ,change the value into zero.
On 04/15/2010 01:52 PM, Dr. Michael J. Chudobiak wrote:
On 04/15/2010 08:24 AM, Richard Shaw wrote:
On Thu, Apr 15, 2010 at 7:21 AM,hewjr1000@gmail.com wrote:
How do I make myself root in the GUI
Running a root GUI login is very much frowned upon. What exactly are you trying to accomplish? The system-config* tools will prompt for root authentication if necessary or you can su (or sudo) to root in a terminal session or login as root in a virtual terminal.
One scenario is when the normal users are all defined over nis/nfs, and the network is down, but you need to log in to fix things...
To fix things in a scenario like that, I boot into runlevel 3 (by temporarily appending "3" to the end of the kernel line in grub), login as root, and run "startx" to get a gui session for root.
- Mike
I just run the required GUI application as a root user. It's a trivial matter to create a desktop short cut that will run as a root user. IMHO this is a better option, as it is inherently more secure. But then I prefer to restrict root user access to only those applications that need it. So I think the Fedora team are right to not have a GUI root login. This is my preference and in no way is it a criticism of any choice of solution others may decide to adopt.
JB
hi tom...
right.. it used to be the pam files as i recall to allow root to login from the login screen... i'm assuming these are the obscure files you're referring to ...
or did the fedora team make other changes in f11/12/13 that i'm not aware of??
thanks
On Thu, Apr 15, 2010 at 7:13 AM, Tom Horsley horsley1953@gmail.com wrote:
On Thu, 15 Apr 2010 06:49:08 -0700 bruce wrote:
and 2, are you guys saying that gnome in fedora 11/12 doesn't allow a user to log in as the root user?
The GDM program doesn't allow you to login as root (though you can edit some obscure files to change that). A gnome session is willing to run as root if you can get past the login hurdles :-). -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
On Thu, 15 Apr 2010 07:44:28 -0700 bruce wrote:
right.. it used to be the pam files as i recall to allow root to login from the login screen... i'm assuming these are the obscure files you're referring to ...
Yea, some sort of pam change seems familiar. I haven't paid much attention since I switched to KDM (for plenty of other reasons besides the occasional root login - things like the ability to modify the X server args to remove the -nolisten tcp).
On 04/15/2010 08:58 PM, Tom Horsley wrote:
On Thu, 15 Apr 2010 08:14:30 -0430 Patrick O'Callaghan wrote:
and we never typed or clicked on anything we didn't mean to
Right. You can type things you don't mean to as easily as click things you don't mean to. I'm just looking for the actual evidence that GUIs are fundamentally evil when running as root, not all this vague handwaving "Oh, it must be horrible!" stuff that seems to be entirely anecdotal or possibly completely imaginary.
While not a "disaster of epic proportions", I've seen non-techies login as root for a GUI session to do some minor admin work. Then they decide to do a "few other things", forgetting or not knowing their actions under root would have consequences. Their actions would create files and or directories in user's areas (most time their own). They would then stay logged in as root for an extended time since they were "happy" to continue working. At some point, they'd logout and later, next day...after lunch, login as themselves and now have all sorts of troubles they didn't have before.
Since they were non-techies they didn't know the concept of file/directory ownership so "permission denied" was a real shocker. So, they'd log back in a root and try to fix things only to make them worse...or make things insecure. Directories which were previously 755 became 777.
Most of these folks had no concept of command line utils and did all their "administration" after clicking on a icon. Had they stuck to that as a regular user and simply typed in the root password they most likely would have done less damage to their system.
I see it as bad practice to login as root for a GUI session. I'm "experienced" and I've not logged in a root for GUI session in years. I do, however, have sudo configured to not ask for a password. Some would consider that unsafe.
P.S. The simplest way to login to the gui as root is to switch to KDM instead of GDM as your login manager. KDM has not yet been taken over by the paranoid thought police :-).
On 04/15/2010 11:42 PM, Ed Greshko wrote:
Since they were non-techies they didn't know the concept of file/directory ownership so "permission denied" was a real shocker. So, they'd log back in a root and try to fix things only to make them worse...or make things insecure. Directories which were previously 755 became 777.
I should have pointed out that when confronted with this new "permission denied" message they would ask their equally non-technical cubical mate who would tell them about the command they learned (chmod) that seemed to fix things...yet not really knowing why. Their advice was "Oh, just do "this"." :-)
On Thu, 2010-04-15 at 08:58 -0400, Tom Horsley wrote:
On Thu, 15 Apr 2010 08:14:30 -0430 Patrick O'Callaghan wrote:
and we never typed or clicked on anything we didn't mean to
Right. You can type things you don't mean to as easily as click things you don't mean to. I'm just looking for the actual evidence that GUIs are fundamentally evil when running as root, not all this vague handwaving "Oh, it must be horrible!" stuff that seems to be entirely anecdotal or possibly completely imaginary.
It's not a question of "fundamentally evil". Security is 99% about avoiding trouble (Google for "principle of minimum privilege"). GUIs are large, complex and buggy pieces of multiple interacting components written by diverse people of widely differing abilities. When you use them as a normal user you at least have the safety net of restricted access to reduce the amount of potential damage. Using them as root removes even that.
poc
On Thu, 15 Apr 2010 23:42:46 +0800 Ed Greshko wrote:
At some point, they'd logout and later, next day...after lunch, login as themselves and now have all sorts of troubles they didn't have before.
"It is possible for idiots to screw up", is not the same as an actual case history of some exploit hitting someone only because they were running a GUI app as root. I'm still waiting for the pointer to those case histories :-).
On Thu, 15 Apr 2010 12:07:01 -0430 Patrick O'Callaghan wrote:
GUIs are large, complex and buggy pieces of multiple interacting components written by diverse people of widely differing abilities.
Which just proves that you should never use a gui for anything remotely sensitive, like accessing your bank accounts or doing your taxes. Nuclear reactor control software should interface with the operators totally through punch card input to avoid the possibility of a gui screwup, etc.
On 04/15/2010 06:01 PM, Tom Horsley wrote:
On Thu, 15 Apr 2010 12:07:01 -0430 Patrick O'Callaghan wrote:
GUIs are large, complex and buggy pieces of multiple interacting components written by diverse people of widely differing abilities.
Which just proves that you should never use a gui for anything remotely sensitive, like accessing your bank accounts or doing your taxes. Nuclear reactor control software should interface with the operators totally through punch card input to avoid the possibility of a gui screwup, etc.
That depends whether the GUI is an integral part of the critical system, or just a communication channel to it. As you may well be aware the GUI is just another service among many that may be running on a Linux system, and the other services may well be accessed by GUI applications as required. Surely you've noticed that although a GUI application may sometimes become unresponsive, it has no effect on other GUI applications. In my experience problems of fatal crashes are rare on Linux systems. They do happen sometimes for me while I'm doing software development/debugging which I don't find surprising, I make mistakes. As for proving anything, to each their own as to how they wish to manage their Linux systems. I know how I manage my Linux PC/Laptop, and it works for me, but as likely as not, it would not be suitable for others.
JB
On Thu, 2010-04-15 at 12:21 +0000, hewjr1000@gmail.com wrote:
How do I make myself root in the GUI
If you have to ask that, we have to ask are you ready to do that?
Any SysAdmin who knows what they're doing would be reticent to do that, or to recommend doing that, would strongly advise not doing that, and should be competent enough to research how to do it without asking for help.
In all seriousness, I would never make any suggestion to the incompetent (general comment to all, not specifically aimed at you) to run as root unless they absolutely have to (which they usually don't). The damage you can do to yourself is bad enough, but the damage you can do to others is really annoying. e.g. All the junk mail, and other internet crap, we all have to put up with that is spewed out from owned boxes. Most of that stuff doesn't come from some spammer using their own computer, it comes from masses of other computers that they've hijacked, one way or another. Don't make it easy for them.
Learn FIRST the principle of least privilege. The more people who adhere to that principle, the better it is for EVERYONE else.
There are a few people who will advocate "use root, don't give a damn about any criticism about it." Personally, I think they're twits, and some (*) of them are evil. I regard those who evangelise dropping your defences with suspicion, not just scepticism.
* They're actively trying to get other people to set up computers in a way that they can take advantage of.
On 04/16/2010 12:41 AM, Tom Horsley wrote:
On Thu, 15 Apr 2010 23:42:46 +0800 Ed Greshko wrote:
At some point, they'd logout and later, next day...after lunch, login as themselves and now have all sorts of troubles they didn't have before.
"It is possible for idiots to screw up", is not the same as an actual case history of some exploit hitting someone only because they were running a GUI app as root. I'm still waiting for the pointer to those case histories :-).
Well, the point being that in this case some directories were set to 777. This allowed others to, for example, read other people's mail, gain access to other people's personal files, photos, etc. Yes, it is a "local exploit". But, if some guy had emails about his colleagues he didn't want to get out...or his cache file was filled with trails of visiting porn sites...or...
I suppose you'd find that OK...and just chalk it up to "idiots". But that is one of the reasons for making it hard for folks to login as root from the GUI. To protect them from themselves.
Yes, some people's view is that everyone should have the choice to shoot themselves in the foot. Some people think their children are very intelligent, and well taught so there is no need in the world for "child guard caps" on medicines and other bottles. Sure, it a pain for older folks with no children in their household...but I think they can request non-guarded bottles at the pharmacy. So, the choice is there to "opt out". And the choice to opt out with regards to the root login exists. But, it isn't easy to do it for the simple reason that if it is easy to do...the "idiots" would be the first ones to do it.
My reasons for not allowing root access for GUI logins is different than what others have and for what you're looking for proof of. IMHO, my reasons are more fundamental and more likely to have real world impact.
Ed Greshko wrote:
On 04/16/2010 12:41 AM, Tom Horsley wrote:
On Thu, 15 Apr 2010 23:42:46 +0800 Ed Greshko wrote:
At some point, they'd logout and later, next day...after lunch, login as themselves and now have all sorts of troubles they didn't have before.
"It is possible for idiots to screw up", is not the same as an actual case history of some exploit hitting someone only because they were running a GUI app as root. I'm still waiting for the pointer to those case histories :-).
Well, the point being that in this case some directories were set to 777. This allowed others to, for example, read other people's mail, gain access to other people's personal files, photos, etc. Yes, it is a "local exploit". But, if some guy had emails about his colleagues he didn't want to get out...or his cache file was filled with trails of visiting porn sites...or...
I suppose you'd find that OK...and just chalk it up to "idiots". But that is one of the reasons for making it hard for folks to login as root from the GUI. To protect them from themselves.
This doesn't sound like something easy to do by accident from a GUI, or at any rate not more easily than CLI. The root cause is that this user had root at all. :-(
bruce wrote:
two questions....
can you point to articles where a user as root was using an IRC client and got zombified??
and 2, are you guys saying that gnome in fedora 11/12 doesn't allow a user to log in as the root user?
thanks
On Thu, Apr 15, 2010 at 6:40 AM, Tim ignored_mailbox@yahoo.com.au wrote:
Richard Shaw:
The system-config* tools will prompt for root authentication if necessary
Tom Horsley:
Thousands and thousands of times in a row, in fact :-).
Not here. Once you've authenticated, that info is cached for a few minutes, and automatically renewed as you keep on doing things as root. And, if you are going to be idle for a while, you can manually extend the period without having to type in the password again (there's an icon in the task bar where you can renew/release it).
I'm still waiting for someone to point me to the web page documenting the actual case histories of horrible things that happened because a GUI app was running as root. (NOT the cases where people did stupid things in GUIs, I want the one that describes people doing perfectly normal safe operations who had horrible things go wrong simply because they were running a gui as root).
Yeah, well, the *usual* thing that cause problems is - the user stays logged in as root, does all their work as root, all *their* files are owned by root, so they have to keep on logging in as root to use their files. They paint themselves into a corner, then use that to justify why they "need" to be root.
If you want further ideas about what goes wrong, go back through the list and look at some of Gene's posts. He runs as root, and comes a cropper over it, often enough.
Traditionally IRC (as root) users have their problems, it's just making it easy for them to become a zombie.
-- [tim@localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Horrors! A root user *and* a top poster!
-
Bill Davidsen -
bruce -
David Liguori -
dhyang -
Dr. Michael J. Chudobiak -
Ed Greshko -
Henry Wyatt -
n2xssvv.g02gfr12930 -
Patrick O'Callaghan -
Richard Shaw -
Tim -
Tom Horsley