Linux Security Series - Su and Sudo

So, if you read my Intro post, you'll know that this is tutorial for the novice linux user, not experts. Also, this article has been in the works for a long time, and I'm finally getting around to finishing/posting it.

This all started with my roommate. He recently got the root password to a linux server to use it. As in, the person sent him the root password, and didn't make him a user account or anything. I've been really into linux/unix since about 2003, and I quickly learned that logging in as root is a bad idea. If you mistype one thing, you can quickly hose your system. Once, I was using the root account (in a way I'll explain later), and I accidentally executed a rm -rf /*. This will delete everything on your computer, even if it's read only. About a second later, I realized what I had done (I meant to do ./*), and hit Ctrl+C to stop it. I did an ls to see what the files looked like, and I got bash: ls: command not found! Oh crap, just deleted lots of important files. Turns out pwd had been deleted also. Anyway, I had to reinstall my OS, and luckily my important files didn't get deleted before I stopped it. And THAT is why you don't want to be root unless you have to!

So, if you don't log in as root, then how do you edit system files/settings, etc? You use the nifty commands su and sudo. Now, If you're a linux/unix user, then you're probably aware of what these commands do, but for those of you who don't: su is short for "substitute use" or "switch user". It allows you to become another user, usually root. When you run su user, and you type in the password of the user you're trying to become. Then BAM! (imagine Emeril Lagasse there), you've got a shell, almost exactly like that user would if they logged in. If you don't specify a user, root is assumed. So, you login as a normal user, do your work, then when you have to do something that requires root privileges, you do su for that part.

Now, what's this sudo I keep mentioning? Well, it's short for (technically, I guess it's not short for, but the same length as) "su do". It's like su, except it is used for running a single command. This makes it much more convenient when you need to run a single command (like to edit a config file), but sudo is much more that that! The biggest advantage of sudo over su, is the logging it provides, as well as the security options it gives a sysadmin.

With sudo, you can specify who can run what commands on which computers. You can even specify what users these commands are run as. You can also specify if a user needs to enter their password or not, and if so, how long before they need to enter it again (if you're running multiple commands at once). Any time someone runs sudo, it gets logged. Who ran the command, what terminal they were on, what command they ran, and what time it was. For all the details check out the sudo site, linked above.

In a later article, I'll detail why you should use sudo, and how to lock down a linux system in regards to using sudo.