dangerous to leave root logged in?

Is it a problem to leave root logged in at all times? Or to leave
root-admin tools (YaST, kuser, ...) running at all times? This is done
on a different X Server than the ones used
for regular users, and noone has physical access to the machine (but
internet is always on).
Note that the regular user activity (email etc) is not done from the
root account.

In fact, is it dangerous to run an (extra) X-server for root
(additionally to the one for the
user)? E.g. SUSE prevents this; logging root into kdm only gives YaST,
not KDE.

On 2005-03-28, hans_schulze98@yahoo.de <hans_schulze98@yahoo.de> wrote:
> Is it a problem to leave root logged in at all times? Or to leave
> root-admin tools (YaST, kuser, ...) running at all times?

A better question is, why do you feel you need root logged in at all
times? There is likely some way to do what you want to do without
leaving root logged in at all.

--keith

--
kkeller-usenet@wombat.san-francisco.ca.us
(try just my userid to email me)
AOLSFAQ=http://wombat.san-francisco.ca.us/cgi-bin/fom
see X- headers for PGP signature information

Some things require periodic watching.
Others need to run for a long time, and the regular users need to do
work during that
time.

On 2005-03-28, hans_schulze98@yahoo.de <hans_schulze98@yahoo.de> wrote:
> Some things require periodic watching.

They can easily be watched over a remote ssh session, so you don't need
to have root logged in at the physical console.

> Others need to run for a long time, and the regular users need to do
> work during that time.

Use batch, at, or cron to run unattended jobs. Use screen to run
unattended jobs that need a controlling terminal.

If none of the above work for you, you'll need to post more specific
details about what you need.

To answer your specific question, there are no specific problems with
leaving root logged in at the physical console if you can guarantee that
no unauthorized users will gain access to the console. But I would
still want to minimize this use if at all possible, just in case, since
it costs little (and can have benefits, since monitoring from an ssh
session can be done from your desk instead of the cold, bitter cold
machine room) and reduces your risk profile (even if possibly not a
whole lot).

--keith

--
kkeller-usenet@wombat.san-francisco.ca.us
(try just my userid to email me)
AOLSFAQ=http://wombat.san-francisco.ca.us/cgi-bin/fom
see X- headers for PGP signature information

hans_schulze98@yahoo.de wrote:
> Is it a problem to leave root logged in at all times?

Yes. That is "Yes". And in case you did not get it, "YES".

> ... Or to leave
> root-admin tools (YaST, kuser, ...) running at all times? ...

See above!

> ... This is done
> on a different X Server than the ones used
> for regular users, and noone has physical access to the machine (but
> internet is always on).

Run _anything_ as root as little as possible, for as short a time as
possible.

> Note that the regular user activity (email etc) is not done from the
> root account.

Thank God.

> In fact, is it dangerous to run an (extra) X-server for root
> (additionally to the one for the
> user)? E.g. SUSE prevents this; logging root into kdm only gives
YaST,
> not KDE.

SuSe is trying to protect you from yourself ;-)

If you want convenience (laziness?), use Windows. What's the point of
subverting the security mechanisms built into *nix?

Root priviledges are sometimes _necessary_ but should be (and usually
are) dropped as quickly as possible by applications.

Applications that _run_ as root (eg., config tools) for their duration
are _not_, _not_, _absolutely_not_ to be left "hanging around" for your
convenience (ie., laziness). Invoke them, use them, then close them.
Period.

Learn to use $ su - from an xterm. Admin gui tools will almost always
automatically prompt you for root password. Some even "remember" for a
minute or two after closing so that you will not be prompted again
during that window. (A convenience, btw, that goes too far, IMO).

A couple of weeks is all most people require to get used to providing
passwords (especailly root's).

hth,
prg

On 28.03.2005, hans_schulze98@yahoo.de <hans_schulze98@yahoo.de> wrote:
> Some things require periodic watching.
> Others need to run for a long time, and the regular users need to do
> work during that
> time.

Why don't you run them under screen?
http://www.gnu.org/software/screen/screen.html
This would eliminate the necessity of root being logged all the time.

--
Feel free to correct my english
Stanislaw Klekot

hans_schulze98@yahoo.de writes:

>Is it a problem to leave root logged in at all times? Or to leave
>root-admin tools (YaST, kuser, ...) running at all times? This is done
>on a different X Server than the ones used
>for regular users, and noone has physical access to the machine (but
>internet is always on).
>Note that the regular user activity (email etc) is not done from the
>root account.

Anything running gives more room for bugs which could allow root
comprimize. Especially something as complex as X.



>In fact, is it dangerous to run an (extra) X-server for root
>(additionally to the one for the
>user)? E.g. SUSE prevents this; logging root into kdm only gives YaST,
>not KDE.

Why would you want to? This is supposed to be on a remote machine with no
physical access.

Maybe you should tell us the problem you are trying to solve and we could
suggest solutions, rather than telling us your solution to an unknown
problem and asking for comments.

As a general rule, the less root is running the better. Any program root
runs is another program which potentially can be cracked and unauthorized
root priv. gained.

hans_schulze98@yahoo.de writes:

>Some things require periodic watching.
>Others need to run for a long time, and the regular users need to do
>work during that
>time.

Lots of root programs run. Having root in an X session while users are
using the machine is just silly.
Cron is a program for running things periodically.
What does root need that needs to run for a long time?

Thanks.
It's not "the" console, it's an extra console or extra X-server just
for system maintenance.
Isn't that safer than typing the root password into an untrusted user's
screen?

Thanks.
It's not "the" console, it's an extra console or extra X-server just
for system maintenance.
Isn't that safer than typing the root password into an untrusted user's
screen?