Rootly Powers

• We now know where our OS came from
• We know how it gets running on our hardware
• We know how to shut it down properly
• But, we still haven't done anything with it
  • Unfortunately, there is still some background we need
  • Who is root, and why do we care?

• Files
  • Three levels of permissions
    • Owner
      • The only person who can change permissions
    • Group
    • Others
• Processes
  • Processes run as a user, with certain user and group permissions
    • "Effective" user ID and group ID are the set of permissions "in force" at the current time
    • "Real" user ID and group ID identify the user who started the process
      • This is the only user who can send the process signals lower its priority
• In both cases, only the numbers "User ID (UID)" and "Group ID (GID)" matter to Unix.
  • Names are there for our convenience, and mapped in files /etc/passwd and /etc/group

• The ultimate owner
  • Root can change permissions on anyone's files, modify any file, run any program, kill any process
• UID 0
  • Always.
  • Other UIDs are arbitrary, but root must be 0, and any user with UID 0 will have all the permissions of root
  • It's a bad idea to have other accounts with UID 0, or to rename the root account
• Only root can:
  • mount & unmount filesystems
  • chroot
  • create device files
  • set the system clock
  • set quotas
  • raise process priorities
  • configure system files
  • configure networking
  • shut down the system
• Only processes running as root may change their effective UID to "become" another user
  • Example: login verifies who you are (called "authentication") as root, then sets its effective UID and GID to your UID and GID and runs your shell

• The most important password on the system (for obvious reasons)
• Should be hard to guess, easy to type
• 8-character passwords are much harder to crack than 7-character passwords
  • And if you have a system that allows longer passwords, use them!
• Change regularly
  • Quarterly???
  • When anyone who knows the password leaves
    • For your protection and theirs!
  • When you think security may have been compromised
• Some sites have a policy of never using the root password (in fact, most of the sysadmins might not even know it)
  • Sysadmin work is done with sudo (see below)

• login
  • BSD-derived systems do not by default allow root logins from "insecure" terminals, which includes all network connections
  • Most System V-ish systems also have this feature these days
  • Disadvantages
    • You have no record of what was done as root
      • Though shell history might provide this
    • You have no record of who logged in as root
• su
  • /bin/su better than su
    • It's a good idea to use the path for commands you run as root, to prevent potential problems from a trojan horse program
  • Advantages
    • You know who became root (because su logs to the syslog facility each time it's invoked
  • Disadvantages
    • You still have no log of what was done as root
  • It's a good idea to use the full path for su, rather than relying on the shell's search mechanism
    • Prevents the possibility of a trojan 'su' somewhere being invoked
  • On BSD-derived systems, only users in group "wheel" can su to root
• sudo
  • A "limited su"
  • Allows only specified commands to be run
  • Advantages
    • Logs all commands run
    • Can be faster than logging in or using su if you need to do a single task
    • Documents who has what privileges
    • Uses the user's own password rather than the root password
  • Disadvantages
    • Can be a real pain if you're doing a lot of things as root
    • User passwords are may be just as sensitive as the root password
    • Many commands can start up a shell (e.g. most text editors & mail programs). If these commands are allowed, you have essentially made that user account into a root account.
  • Configurable
    • Can allow certain users to run only certain commands
    • Can allow certain users to run any command BUT certain commands
      • Less secure
      • Any time you give "anything but..." permissions, you leave an opening for a "dangerous" option to show up in the "anything" group.
    • Example configuration (p. 42 in the book):

   # Define aliases for machines in CS & Physics departments
   Host_Alias  CS = tigger, anchor, piper, moet, sigi
   Host_Aias   PHYSICS = eprince, pprince, icarus

   # Define collections of commands
   Cmnd_Alias  DUMP = /usr/sbin/dump, /usr/sbin/restore
   Cmnd_Alias  PRINTING = /usr/sbin/lpc, /usr/sbin/lprm
   Cmnd_Alias  SHELLS = /bin/sh, /bin/tcsh/, /bin/csh

   # Permissions
   mark, ed   PHYSICS = ALL
   herb       CS = /usr/local/bin/tcpdump : PHYSICS = (operator) DUMP
   lynda      ALL = (ALL) ALL, !SHELLS
   %wheel     ALL, !PHYSICS = NOPASSWD: PRINTING

• One thing to watch out for with sudo is that many commands allow a "shell escape." If you allow one of those commands (vi is an example), you are really allowing any command on the system.
• ssh (Secure Shell -- not mentioned in this chapter)
  • Is similar to login, but...
  • Encrypts network connections
  • Sets up X-window system forwarding
  • May bypass "no root login" prohibitions
    • This may be good, may be bad

• daemon
  • Owns and runs certain processes, e.g. lpd
• bin
  • Owns system commands and their directories
• sys
  • Owns kernel, /dev/mem, /dev/kmem on some systems
• nobody
  • Usually UID -2 or -1
    • May show up as UID 65535, depending on how the system interperts the most significant bit (i.e. is the UID signed or unsigned?)
  • The user assigned to root on other machines when accessing your system via Network File System (NFS)
    • Unless you explicitly state that root on a system has root permission on your system as well
  • Also sometimes used for things like web servers where files are accessed, where you want no special permissions given away
    • Often a special user called "www" or something similar will be used for this
    • The idea is that you want the server running as a user who has absolutely no special permissions on the system, and can only access things that are "world" accessable