27

I am fairly new to server administration, and I have seen a lot of sites recommending to assign sudo privileges to a user created by the root user and giving the root user an insanely long password for security enhancement.

If the newly created user can perform the same functions as a root user however, what is the actual benefit of doing this at all?

1
  • 8
    The sudoer can't do everything root can, only what root allows sudoers to sudo, and the sudoer still has to sudo the command. Lastly, sudoers sudo things as their own user account, first meaning they don't have to log in as root, and second allowing you to see who sudid something.
    – KeithS
    Aug 10, 2012 at 21:35

5 Answers 5

50

There are several benefits to using sudo over handing out the root password. In no particular order:

  • You aren't giving out your root password
    As a general rule, if someone leaves your company and they knew the root password(s) you now have to go change those passwords everywhere. With proper configuration management this is a minor annoyance. Without it it's a huge chore.

  • You aren't giving away the keys to the kingdom
    sudo allows you to specify a restricted list of commands that users can run, so if you decide that Alice only needs the ability to stop and start Apache, but Bob needs full root rights you can set them up accordingly.

  • You can manage authorization centrally sudo supports LDAP configuration, which means every system in your company can look at a central LDAP server to determine who is allowed to do what.
    Need to authorize (or de-authorize) someone? Change the sudoers configuration in LDAP and all your systems are updated at once.

  • There's an audit trail
    With the exception of users that are allowed to do sudo su - , sudo sh , or something equivalent, sudo will produce an audit trail of which user ran what commands.
    (It will also produce a list of the people who gave themselves an unlogged root shell, so you can point your finger at them and hiss in disapproval.)

  • sudo is good for more than just root Everyone concentrates on sudo as a way to do stuff as the superuser, but that's not all it's good for.
    Say Alice is responsible for a particular software build, but Bob should be able to run the build script too. You can give Bob an entry in sudoers that lets him run the build script as Alice's user. (Yes, sure, there are much better ways to deal with this particular case, but the principle of Let user A run a program as user B can be useful...).
    You also get all the same audit-trail benefits that I mentioned above when you do this...

10
  • 1
    Very helpful answer - if I know (and I mean with 100% certainty) that I am going to be the only one managing a single server however, do you see much benefit to assigning sudo privileges to another user (which would be myself anyway) outside of preventing myself from screwing something up?
    – JM4
    Aug 10, 2012 at 20:13
  • 3
    @JM4 Consistency, and good practice for one day in the future when you're working in a larger environment. From a practical standpoint you should never be logging in as root directly unless you're on the physical console fixing something that is royally hosed, so sudo versus su is an academic distinction - you're going to have to jump through one hoop or the other. Using sudo offers you the chance to exercise the principle of least privilege (my last point) where practical, and that's always something to seriously consider.
    – voretaq7
    Aug 10, 2012 at 20:31
  • 2
    Also, use visudo to edit your sudoers file. Aug 10, 2012 at 20:34
  • 3
    Note that many interactive commands will allow users to bypass the audit trail. For example, any user who can sudo vi can :! bash once inside vi. Aug 10, 2012 at 21:57
  • 4
    @DietrichEpp The NOEXEC tag helps in that case. Aug 11, 2012 at 0:25
17

The primary difference is that users authenticate to sudo using their own password, whereas with su or direct root login the root password is used.

This means that you don't have to share the root password with all and sundry, and that if you need to disable root access for one or two users in the future, you can just disable it for them, instead of having to change the root password.

sudo is also capable of limiting which commands each user can run as root, so specific users can be given access only to the tasks they need to perform, if they do not require full root access.

1
  • 1
    thank you for your help. I see the benefit from your point, but I also really looked at a basic user to root user as a double authentication point given I have disabled root user login from ssh on my server.
    – JM4
    Aug 10, 2012 at 20:06
4

On top of the answers given, which are valid, don't forget that a user logged as root can potentially break the system at every command. If you force them to type sudo before doing something potentially dangerous, at least you make them aware that they need to double check before doing a particular command.

2

Yes indeed - from a control and logging perspective sudo is much better.

For example - if you su the only event captured in the logs is you su'ing. Anything after that goes as root. And if you've ever looked at logs in Unix/Linux you know root does a butt load of stuff.

Sudo on the other hand logs pretty much everything AS the originating user.

0

Using sudo makes it harder for a malicious user to gain access to a system. When there is an unlocked root account, a malicious user knows the username of the account she wants to crack before she starts. When the root account is locked, the user has to determine the username and the password to break into a system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .