[split] running desktop as root

Gullible Jones · 2006-08-20 00:43:57

peterk0 wrote:

xfce4.4 beta
gtk - rezlooks
icons - tango
filemanager - thunar
terms - terminal, tilda
fonts - dejavu sans, snap

Whoah... Nice wallpaper. Where's it from? :twisted:

BTW, are you running the desktop as root? :shock:

peterk0 · 2006-08-20 09:53:43

Gullible Jones wrote:

peterk0 wrote:
xfce4.4 beta
gtk - rezlooks
icons - tango
filemanager - thunar
terms - terminal, tilda
fonts - dejavu sans, snap

Whoah... Nice wallpaper. Where's it from? :twisted:
BTW, are you running the desktop as root? :shock:

yep i'm runnig my desktop as root, that's 'cause i'm too lazy to su each time, or even sudo. still waiting for ANY argument why not run is as root, so feel free to convince me

bboozzoo · 2006-08-20 10:02:56

peterk0 wrote:

Gullible Jones wrote:
peterk0 wrote:
xfce4.4 beta
gtk - rezlooks
icons - tango
filemanager - thunar
terms - terminal, tilda
fonts - dejavu sans, snap

Whoah... Nice wallpaper. Where's it from? :twisted:
BTW, are you running the desktop as root? :shock:
yep i'm runnig my desktop as root, that's 'cause i'm too lazy to su each time, or even sudo. still waiting for ANY argument why not run is as root, so feel free to convince me

say your fingers slip somehow and you end up typing rm -rf / simple as that

peterk0 · 2006-08-20 11:05:21

bboozzoo wrote:

say your fingers slip somehow and you end up typing rm -rf / simple as that

well that never happend to me in like 5 years i'm using linux and if it does i'll know i f*cked up
when i was asking the question, i thought more of a security reason.

Gullible Jones · 2006-08-20 14:40:53

peterk0 wrote:

Gullible Jones wrote:
peterk0 wrote:
xfce4.4 beta
gtk - rezlooks
icons - tango
filemanager - thunar
terms - terminal, tilda
fonts - dejavu sans, snap

Whoah... Nice wallpaper. Where's it from? :twisted:
BTW, are you running the desktop as root? :shock:
yep i'm runnig my desktop as root, that's 'cause i'm too lazy to su each time, or even sudo. still waiting for ANY argument why not run is as root, so feel free to convince me

If an application running as root is exploited, your system can be totalled.

Linux malware often requires root priveleges to install itself.

"root" is an obvious username. If you have sshd running, it's the first thing a would-be cracker would pound away at.

You can use sudo without a password if you're truly lazy.

(If you're still set on running as root, at least use a very strong password...)

Gullible Jones · 2006-08-20 16:19:14

Alright, have it your way....

phrakture · 2006-08-20 20:03:47

peterk0 wrote:

well, i'm lazy to use sudo without pass
anyway i have a very strong password, i don't run any services visible from outside (internet) and i only install progs i'm convinced are clean (which is not 100%) and always check their checksums. if i occasionally run sshd, login as root isn't permitted and i have an special acc from which i su to root after login...
so far i'm good, nothing happend and i can be lazy

Running a desktop system as root is not called "laziness" - it's called "stupidity"

peterk0 · 2006-08-20 21:02:34

phrakture wrote:

peterk0 wrote:
well, i'm lazy to use sudo without pass
anyway i have a very strong password, i don't run any services visible from outside (internet) and i only install progs i'm convinced are clean (which is not 100%) and always check their checksums. if i occasionally run sshd, login as root isn't permitted and i have an special acc from which i su to root after login...
so far i'm good, nothing happend and i can be lazy
Running a desktop system as root is not called "laziness" - it's called "stupidity"

well, you're very welcome to give a reason why not to

baze · 2006-08-20 21:09:08

peterk0 wrote:

phrakture wrote:
peterk0 wrote:
well, i'm lazy to use sudo without pass
anyway i have a very strong password, i don't run any services visible from outside (internet) and i only install progs i'm convinced are clean (which is not 100%) and always check their checksums. if i occasionally run sshd, login as root isn't permitted and i have an special acc from which i su to root after login...
so far i'm good, nothing happend and i can be lazy
Running a desktop system as root is not called "laziness" - it's called "stupidity"
well, you're very welcome to give a reason why not to

you were already given reasons why not to but all you answered to that was "well i'm lazy" [...] when you tell anybody to give you reasons why you shouldn't use root as for the desktop but you're not going to listen to them anyway, it's pretty useless to give you reasons, isn't it?

peterk0 · 2006-08-20 21:24:24

baze wrote:

you were already given reasons why not to but all you answered to that was "well i'm lazy" [...] when you tell anybody to give you reasons why you shouldn't use root as for the desktop but you're not going to listen to them anyway, it's pretty useless to give you reasons, isn't it?

i'm really sorry you had to read all that lazy stuff and i promise i won't ask for more reasons. i just felt that the reasons given like accidentaly deleting your /, or logining into sshd as root, installing untrusted progs etc. were either irrelevant (if you delete your / you're a nut) or configurable (like not permitting remote logins as root) so i was really looking for some good reason.
but hey, maybe it's just not the right thread for this stuff.

jaboua · 2006-08-21 17:51:23

Someone could for example exploit a bug in firefox or IRC client to run "rm -rf /" for you...

phrakture · 2006-08-21 19:52:42

I split this, as it was clutter in the screenshot thread.

As for my comment being "rude", princeton defines stupidity as "a poor ability to understand or to profit from experience".
The original poster has said he's heard all the arguements, and has now had a handful of people tell him why not to do it, but he has not "profited from experience."
Thus, the princeton definition stands, no?

Cerebral · 2006-08-21 20:22:27

peterk0 wrote:

still waiting for ANY argument why not run is as root, so feel free to convince me

Gullible Jones wrote:

If an application running as root is exploited, your system can be totalled.

peterk0 wrote:

i just felt that the reasons given like accidentaly deleting your /, or logining into sshd as root, installing untrusted progs etc. were either irrelevant (if you delete your / you're a nut) or configurable (like not permitting remote logins as root) so i was really looking for some good reason.

Looks like you ignored, or didn't notice, the reason why I'd never run a root desktop - if, for example, there's a buffer overflow flaw in my email client, somebody can send me an email that automatically runs rm -rf / for me. Hardly irrelevant or configurable. Sure, there might be only a small window that it may be exploitable, say up to a certain version, but the chance is still there.

clam wrote:

Desktop Windows runs by default with users given powers tantamount to root privileges.

And that's the prime reason, imo, that malware and viruses are so easy to propogate across windows systems - there's literally nothing stopping them from installing themselves. Granted, anti-virus apps can now scan emails and attempt to check all running programs for infection, but 99% of the time if an AV program finds a virus, that's because your system is already infected - it's less preventative and more reparative, which seems to me to be a bad thing.

Anywho, my 2 cents are now immortalized in electron form. Do with them what you will.

phrakture · 2006-08-21 20:40:58

Actually, jaboua already said something similar, but you went more verbose

jaboua wrote:

Someone could for example exploit a bug in firefox or IRC client to run "rm -rf /" for you...

Cerebral · 2006-08-21 20:45:28

phrakture wrote:

Actually, jaboua already said something similar, but you went more verbose

Crap, yup. Beat me to the punch, by about three hours... damn I gotta read these threads more carefully from now on.

pauldonnelly · 2006-08-21 21:20:35

It's like having sex without a condom. Sure, you probably won't get a disease, and you can probably avoid getting anyone pregnant, but you're going to feel awfully dumb when it finally catches up with you.

I've never once almost deleted critical files, only to be saved because I wasn't running as root, and I don't really expect to... but I'm not cocky enough to assume I'll never make a mistake. It would be fairly easy to destroy /etc when I was aiming for /etc/something.conf. Not likely, but one slip will do it.

I'm pretty careful about the software that I run on my system -- when I run a program without a good reputation I skim the source -- but it's concievable that some malicious code could sneak in. I'd rather not have that code running as root, for obvious reasons. I'm also not sure that every piece of software I run is bug free. Anything that talks to the Internet, as others have said, is a potential attack vector.

As a fairly lazy person myself, I weigh the effort needed to run "su" whenever I need to work as root against the effort needed to wipe and reinstall everything on my system in the event of a malware incident or a PEBKAC moment. So no general root login for me.

peterk0 · 2006-08-22 06:26:02

i'm really glad the discussion is finaly going somewhere, however i have to comment the rm -rf /.
I'm regulary rsyncing all my data to a usb disk, have all my configs on the internet in svn and all my private data (which matters the most) backuped up once more on cd-r/dvd-r. if rm -rf / happends for any reason i can get my whole system back in less than an hour.
Than again if rm -rf / happends and i'm logged as an regular user, all my private data is gone anyway (and that's what really matters) so rm -rf / spooky stories don't really aplies to me

but i got your point really

Dusty · 2006-08-22 06:31:51

You know, my biggest worry would actually be if an exploit set up my server for spamming or for hacking into another box or something and my IP got banned so I couldn't connect to the Internet, or worse, somebody set me up to take the fall for their crime.

Dusty

smoon · 2006-08-22 10:04:13

Dusty wrote:

You know, my biggest worry would actually be if an exploit set up my server for spamming or for hacking into another box or something and my IP got banned so I couldn't connect to the Internet, or worse, somebody set me up to take the fall for their crime.
Dusty

This can't happen if you're using your Desktop as ordinary user only? :shock: I'm not saying it doesn't make a difference if you run it as root or normal user, but someone can still exploit a bug in some program you're running as someone else than root and make your computer part of their botnet or whatever. Of course it will be harder to hide his Daemond that listens on port 31337 if the attacker doesn't have root privileges but if you don't check you won't find i either.

test1000 · 2006-08-22 11:43:49

How do you check daemons btw? they are not listed in ps auxw ?

about the "i'm not running as user because i'm too lazy": I used to be there, when i was new to linux, and got a ton of flak from "experienced" linux users called me stupid and all sorts of names and nobody were interested in any kind of discussion. What finally won me over was the fact that with some programs you HAVE to be user to make them work; because the author obviously haven't evisioned people running them as root or he has such a contempt for people trying to run it as root that he won't implement it.
So it was that, coupled with the discovery of sudo(which supports tab completion thank-you-very-much) unlike su -c (which i have nothing but contempt for now ) AND doesn't require a password which finally won me over.

Granted iv'e gotten some new insight into the problem at hand now, thanks to this thread: which is 10x better to have than the FUD dogma spewed on every linux msgboard on this planet which never explains WHY you should not run root, other than "it's not secure" -- which might just as easily be something repeated by the meek masses -- when running as root has it's definitive advantages and the alternatives are not so clear yet.

Then later iv'e discovered how great & easy sudo is to allow multiple users get access to certain applications which normally would have required root privilegues -- making me wish i've just used sudo from the beginning!

What I think this is a great example of is the "do-not-question-authorities/dogma" culture which exist still sometimes outthrough the linux community and which never helps but just serves to obscure the issues at hand.

What comes to mind; the great words of fightclub:
Your not your fucking khakis

Well, your not your fucking OS either: so don't think you need to defend it.

pauldonnelly · 2006-08-22 14:35:05

How do you check daemons btw? they are not listed in ps auxw?

Aren't they? I see acpid, crond, gpm, and some kernel daemons in my output.

peterk0 · 2006-08-22 16:25:15

test1000 and clam thank you gyus, you two just exactly got my point :!:

from the start it was all about the fact, that the community reacts to certain issues almost automaticaly without knowing the pros and cons (or thinking about them), just because they heard them somewhere.

for me it's just much more comfortable running my desktop as root (according to circumstances i described, i.e. not running any critical services visible from internet). if i have been running such stuff, i would consider running my desktop as a normal user, however it's questionable why run server services on desktop when hardware is so cheap nowadays.

Gullible Jones · 2006-08-22 17:58:21

Read this please. It may sound a bit overenthusiastic, but please, pay attention about what the author says about the root account...

Snowman · 2006-08-23 01:02:39

pauldonnelly wrote:

How do you check daemons btw? they are not listed in ps auxw?
Aren't they? I see acpid, crond, gpm, and some kernel daemons in my output.

They are also listed in /var/run/daemons/

benplaut · 2006-08-23 01:40:21

running as root removes the most important security advantage between windows and 8nix like systems.

It's easy to brute-force a ssh account. It's even easier when it's the most obvious username in the book.

Sure, it probably won't happen. The fact remains, do you want to take that risk? There aren't all that many linux virii right now (none in the wild, afaik), but when one does get loose, i'd bet my left shoe that it targets root.

There's no reason not to run as user, except for laziness.

I don't think i need to retype a million reasons.

Arch Linux

#1 2006-08-20 00:43:57

[split] running desktop as root

#2 2006-08-20 09:53:43

Re: [split] running desktop as root

#3 2006-08-20 10:02:56

Re: [split] running desktop as root

#4 2006-08-20 11:05:21

Re: [split] running desktop as root

#5 2006-08-20 14:40:53

Re: [split] running desktop as root

#6 2006-08-20 16:19:14

Re: [split] running desktop as root

#7 2006-08-20 20:03:47

Re: [split] running desktop as root

#8 2006-08-20 21:02:34

Re: [split] running desktop as root

#9 2006-08-20 21:09:08

Re: [split] running desktop as root

#10 2006-08-20 21:24:24

Re: [split] running desktop as root

#11 2006-08-21 17:51:23

Re: [split] running desktop as root

#12 2006-08-21 19:52:42

Re: [split] running desktop as root

#13 2006-08-21 20:22:27

Re: [split] running desktop as root

#14 2006-08-21 20:40:58

Re: [split] running desktop as root

#15 2006-08-21 20:45:28

Re: [split] running desktop as root

#16 2006-08-21 21:20:35

Re: [split] running desktop as root

#17 2006-08-22 06:26:02

Re: [split] running desktop as root

#18 2006-08-22 06:31:51

Re: [split] running desktop as root

#19 2006-08-22 10:04:13

Re: [split] running desktop as root

#20 2006-08-22 11:43:49

Re: [split] running desktop as root

#21 2006-08-22 14:35:05

Re: [split] running desktop as root

#22 2006-08-22 16:25:15

Re: [split] running desktop as root

#23 2006-08-22 17:58:21

Re: [split] running desktop as root

#24 2006-08-23 01:02:39

Re: [split] running desktop as root

#25 2006-08-23 01:40:21

Re: [split] running desktop as root

Board footer