Where I work everybody logs in as root

Question

Where I work now, I am forced to use the root account just like everybody else there does. There are no other users. Not even in the DBs. My seniors explained to me that this is done for convenience's sake.

I really know this is wrong but I would really like to have a real life example or a very convincing theoretical one so I can prove to them how wrong this is. Not for retaliation or something like it, but maybe help them understand the risk more and improve our security.

Actually it is really stressful to work as root. In my home network (and boy is it a big home vm network) I don't even dare to login as root..

They are aware of the threat of accidental erase or modification of crucial files and folders. Of the threat of accidental permission changes.

They insist that we must double check our programs and our behavior before pressing the "enter" button..

What else could go wrong?

I suspect an external attack (apache wise). Also a rogue program. Can a rogue program take control through apache's wrong permissions?

What else is possible? Thank you!

Answer 1

Lets just delete some old logs from the webserver. No need to login as the web account, we got root.

rm -rf / var/www/logs/2010.log

Woops! Shouldn't have been root.

Answer 2

Hm.. I've done many bad things as root. I once wrote a script that was supposed to (among other things) periodically clean a directory called /foo. So the script was executing as root and did something like this:

cd /foo
rm -rf *

One day the /foo directory didn't exist because of some problems with our SAN. Result: catastrophe.

Now this is of course just a badly written script; it should have been:

cd /foo  &&  rm -rf *

but it shows you how easy it is to do something seriously bad if you have too much privilege.

The other problem you have when everybody logs in as root is as that you loose the whole traceability/auditability thing. Who knows who has done what? Is that really acceptable?

The question to ask yourself (and your employer) is: what is that you need to do that requires you to be root?

On this particular topic I really prefer Solaris over Linux. (please don't flame, I'm only talking about the topic of the root user). Even if you are not on Solaris I believe there things to be learned from how Solaris does it. You may be able to mimic some of this on Linux.

Solaris (later versions) doesn't by default let you login from outside as root at all. Indeed root has become a role rather than a regular user. If you have the sufficient privilege and know the root password then you can of course login to root, but only after having logged into the host as yourself first and then su into root. This way you can always see who has used the root account.

Furthermore you have the whole fine grained privs setup on Solaris, for example you can assign the privilege to bind to a socket <1024 to a particular service. On Linux such a process must be started by root. Secondly you have RBAC and delegation of SMF privileges (the right to start, stop or administer a given service). With this there's rarely a need for anything really to done as root.

Solaris really - by the way it is configured out-of-the-box as well as the features it offers - discourages you from using root and makes it easy never to use root account. I hope one day to see the same advances in Linux.

Your boss' counter-argument to all of this is that it will take time to define and configure. This is true but your site seems pretty big. So the key word is standardization. Define those roles once and for all by utilizing the features that your OS brings you. Then standardize across all your servers. The other keyword I would like to bring to the table is principle of least privilege. You should never have more privilege than your job requires. Unfortunately you are at the mercy of how fine grained your OS's privilege model and delegation model is but read up on it and you will likely see that your OS has done great advances in this area in the past 10-15 years so there's perhaps no longer a need for you to login as root?

Apache httpd shouldn't run as root. Period! If your webserver gets hacked then the intruder suddenly has root privilege. Your OS may force you to start it as root but apache httpd has a feature for immediately switching to another user. Look into User and Group settings in the config file for Apache httpd.

Answer 3

Utter stupidity! this is just asking for trouble. I think the seniors need to be fired for convenience sake.

Apart from accidentally doing something wrong (like rm -rf / which would have limited effects if you were not root) if someone gets fired due to making a dumb mistake that kills a critical server. They might just get all angry and log in remotely and take down the network, or change the root password so no one can log in and encrypt the root partition or otherwise really mess with your network! Guess what? No one would have any idea who did it because they used the root account that everyone knows the password to, including all ex-employees.

I strongly suggest you set up some sort of user accounts and only for those that need such access. Where root access is required use sudo. You can also limit per user or per group what they can do with sudo, which programs can be run etc.

Now if an employee leaves, you can remove the user simply by deleting the account.

Answer 4

This is so idiotic that is hard to explain why this is so bad.

You asked for examples of what could go wrong. Here's one:

• If all applications that use the database server log in with an account that has read/write access to ALL databases, a single web app (like a WordPress site with a buggy or out-of-date plugin) can grant access to all databases. Data can be stolen or just deleted.

And, just saying, maybe the OS root password and the database root password are the same?