D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] root vs sudo vs su (was Server got hacked)

 

On 20/12/13 19:56, Simon Waters wrote:
> Systems didn't enable sudo by default in the past. root had to add users and 
> commands to make it happen.

OpenBSD still does this by the way: you can create a new user during the
install, but it won't be granted any privileges beyond normal user
rights. After your first reboot, the very first thing to do is still
login as root, cvs the ports tree and fetch/build/install your favourite
shell and sudo, and then grant yourself escalation rights as appropriate
(I still favour the %wheel group personally, as you say, for historical
reasons).

I know people feel differently here on the list, but I personally
*NEVER* use root, ever (except for the obvious and highly specialised
exception above). On every UNIX system I've ever looked after, I prefer
to use a privileged account and operate via sudo, pfexec or whatever
rights-granting system is in place. My logs stay nice and clean that
way, the way I like them. In fact, a root login of any kind on my
systems triggers the alerts immediately!

Regards

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq