Re: dangerous to leave root logged in?

From: Michael Zawrotny (zawrotny_at_sb.fsu.edu)
Date: 03/30/05 

Date: 30 Mar 2005 17:36:00 GMT

Shane (aka froggy) <spamspamuber.l33t.god@spamgmail.com> wrote:
>
> > But if he has four xterms open, one of which is a root shell, he
> > might accidentally get the focus into the wrong one.
> >
>
> I am constantly guilty of this I have multiple xterms open some
> with root logged in and the number of times I have executed
> commands as root when I meant to do this as a user is to the point
> you would have thought I have learnt my lesson by now (usually I
> wince for an hour or so then go right back to doing it)

I avoid this with a short shell script (see below) that I call "rw" for
"root window" that sets the background color to one color if it is a
local root, and a different one if it is remote. This way I am clued
in immediately by the background color about whether a given window is
running as my regular user account, local root, or remote root.

That being said, I screen lock my workstation when I walk away from
it, and my office door is set so that it locks when it is closed. I
would never leave an unlocked root window/console on a machine used by
regular (non-priveleged) users.

If the OP insists on leaving root logged in on a multi-user machine,
despite the recommendations of everyone here (myself included), the
best that he can do is to set the screensaver to lock after one minute
of idle time (for X), and/or religiously use either "vlock" or
"lockvt" (for console) when walking away from the machine. But these
are at least somewhat fragile in that they rely on either a small
timeout or remembering to lock *every* time you walk away. So the
answer still mostly boils down to "don't do that".

mez{~}$ more ~/bin/rw
#!/bin/sh

if [ $# = 0 ] ; then
    bg=lightblue
    host=`hostname | perl -pe 's/\..*//'`
    root="su -"
else
    bg=cadetblue
    host=$1
    root="ssh $host -l root"
fi

title="root@${host}"

PATH=${PATH}:/usr/X11R6/bin
xterm -bg $bg -fg black -fn 7x14 -title $title -e $root &
# end of rw script

Mike 

-- 
Michael Zawrotny
Institute of Molecular Biophysics
Florida State University                | email:  zawrotny@sb.fsu.edu
Tallahassee, FL 32306-4380              | phone:  (850) 644-0069

Relevant Pages

  • Re: NFS lockdep lock misordering mmap_sem<->i_mutex_key with 2.6.32-git1
    ... VFS: Mounted root (nfs filesystem) on device 0:15. ... udevinfo/2551 is trying to acquire lock: ... More majordomo info at http://vger.kernel.org/majordomo-info.html ...
    (Linux-Kernel)
  • Re: Why Disable Root ssh login?
    ... Think of a username and password as a lock and a key. ... Disabling direct root login helps put an extra layer around it. ... Its better to use SSH key pairing and authenticate using all 3, ...
    (Debian-User)
  • Re: security for a home system
    ... useless since physical access to the box means that they can get root ... You can make that tricky with a Master lock using the lock loop on the case ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: New FU9 x86-32 install on spare box, how to switch to kde?
    ... temporary PackageKit process, and you should simply wait for it to ... Removing the resources yum uses to tell if there's a lock ... You'll probably need to be root to kill any back-side PackageKit stuff ...
    (Fedora)
  • Re: Linux 2.6.16.16
    ... Information whether it's a DoS or a root exploit is helpful, ... qualified person doing risk management will anyways lookup the CVE. ... It is insane to be giving lease_initthe task of freeing the lock it is ... Also fix a slab leak in __setleasedue to an uninitialised return value. ...
    (Linux-Kernel)