To Root or Not To Root

[wread]

@all
I was testing Porteus-Cinnamon in VirtualBox. I loaded the iso in VB and pressed start. Our beloved splash popped in and as usual I selected "Always Fresh"....
After a while a nice desktop appeared, I opened "File" and saw only the iso. Good, I opened GParted, formated my virtual HD, copied my iso to the VHD, installed Cinnamon in my HD, rebooted without iso, Fine bussiness!

But what I haven't said is how many times I had to tip "toor" to authenticate myself.....at least ten times!

If I start in AF mode, it is supposed I know what I am doing! -or not?

If we offer a gratis basic operating system that the user should complete with custom modules and to install those custom modules one must be root, then I do not see why AF should start as guest.

Request For Comments 8)

[brokenman]

Needless to say, this is going to start a flame war!

If I start in AF mode, it is supposed I know what I am doing! -or not?

This is a bold and very general assumption. It could mean you don't know what you're doing and you messed something up and someone on the forum asked you to boot into AF mode.

If we offer a gratis basic operating system that the user should complete with custom modules and to install those custom modules one must be root, then I do not see why AF should start as guest.

What you say is akin to a windows user being an admin, just because he has to authenticate when he installs downloaded software. What about a user who builds Porteus on our super friendly web builder? They didn't install anything. Nor did the person who downloaded modules and placed them in the modules folder (perhaps using windows to do so) when creating their custom Porteus. AF mode is not about knowing what you are doing, it is about having the freedom to do what you want without breaking the system EVEN IF you don't know what you are doing.

I use Porteus exclusively in AF mode. I would never use my day to day operating system as a root user in a desktop environment. I understand why some people would want to so here is what I have done. If one REALLY knows what they are doing they can give the guest user the privileges they require to do almost anything they need. The exceptions are some of the custom Porteus scripts such as xzm2dir which look specifically for a root user. In the next release I have added a function that will check to see if your are root OR you are in the wheel group. This will help those that want to boot as root. You will need to tell me which actions you use most that require elevated privileges and I will do my best to make it easier for you.

[francois]

@wread:
Sorry to ask such a question, what AF mode standing for?
Neophytes have the right to know. 8)

If you are uneased with guest mode? Just get to root mode:

Code: Select all

su
toor
nemo or whatever

[wread]

@brokenman
We must get back to the philosophy of Porteus...
Do we want to have ten million idiots using the system or do we want to have many thousands who know what they are doing?
As a teacher I know you learn by doing. You and I we have messed a system more than once working as root, right? If you don't let them be root they will never learn.

I myself have tough Informatics for Engineers with Porteus 2.0 - I think - and experienced the most unthinkable mistakes the students do!, but they learned by doing 8) . My students wanted to be root. Guest is thought for others "using my computer".

My experience....

[brokenman]

AF = Always Fresh

We must get back to the philosophy of Porteus...

You will need to define the philosophy of Porteus further. One aspect of this, in my humble opinion, is to try to be as idiot proof as possible.

Do we want to have ten million idiots using the system or do we want to have many thousands who know what they are doing?

The second option would be ideal however, the fact is that the first option is more likely. If you are in the second group (you know what you are doing) then you will know how to get into root mode. If you are not in the second group then you shouldn't be root.

As a teacher I know you learn by doing. You and I we have messed a system more than once working as root, right?

Yes I have broken systems before during learning. Nobody is stopping a user from becoming root. That is not the issue.

It is true that a user won't learn without becoming root, but don't you think it is better to start with training wheels first? When I say training wheels I mean the option to elevate to root if and when you need it. Like I said, nobody is prevented from becoming root and those that know what they are doing can easily do this.

[Bogomips]

nobody is prevented from becoming root and those that know what they are doing can easily do this.

Like in Mint where you can always sudo without pw to do the root thing. In fact it is the way I have my sudo set up. 8)

[donald]

Nothing will prevent silly users from doing silly things.
BUT:
sudo = reducing security to make it more 'user friendly'.
Sudo is great for a live-CD but should not be installed on any working desktop.
Admin level control should only be available to admin level users, root.
sudo can be used IF you secure it properly, and IF you do everything right -- are you sure you did?

passwordless sudo, hell why not just have only a root user, no firewall
and leave all ports open too.

[Bogomips]

Sudo is great for a live-CD but should not be installed on any working desktop.

Sudo in AF mode no different from from live CD. Anyway instead of live CD loadng from ISO file. Also no problem from live CD to sudo rm -rf /mnt/sda1/*.

[donald]

^
Same is true for the login=root cheatcode
That's why porteus is a nice little OS to carry on an usb-flash.
Ofcourse one can use it as the main/only OS but one should be the "one and only" user then.

[Bogomips]

^ Same is true for the login=root cheatcode

Not by a long shot:

• Not all instructions run as root. Only any which need elevated privilege. This allows stop and think time.
• Any script invoked will also run with root privilege. Very easy to make wrong assumption about what a script will do, when writing one.
• GUIs will also run with root privilege, meaning File Manager can delete anything, and very easy thru forced error to select wrong object for deletion. Same goes for text editor mangling important file in /etc, etc.

[brokenman]

One of the principal reasons people use a computer nowadays is to open a web browser. Can you think of any advantages of running a web browser as root? Now, can you think of any disadvantages?

[donald]

@ Bogomips

This allows stop and think time.

One should "think" before doing something, and that's exactly the problem,no?

However, what was meant is:
As long as one, (whatever kind of idiot may sit in front of the keyboard),
can invoke the login=root cheatcode, or use the, (most likely), not properly configured
sudo command, (read man sudo - security), you have lost.

So this OS is a nice one to carry in your pocket, but never, never allow it to boot
(or any other Live-CD/USB) on a maschine you are responsible for.(as an Admin)

To be fair, i do not care that much for Home-boxes,
but if your offspring is even a little clever, you should be aware that your Files/OS are/is not secure.

[jssouza]

Not all instructions run as root.

Hi Bogomips,

Just for my understanding (and learning) could you give an example for this? I thought anything could be run as root.

Thanks!

[wread]

@all
For me the problem is already solved. I entered in text mode, switched to x and started cinnamon.
I extracted 003-cinnamon, opened /etc/slim.conf and modified the default user, setting root instead of guest; made the new 003-cinnamon.xzm and

Regards!

[ncmprhnsbl]

heres a quote from another forum that i found to be to the point:

The security concern here is NOT that you as a user cannot be trusted with a root login, but that all the software associated with your DM of choice will then be running with root privileges and THEY cannot neccessarily be trusted. Every little bug in any of those tools might escalate to a systemwide threat when they have complete access to everything. That is why you should run only those tools with root privileges, that really need them to operate.