On 06/09/2014 01:29 PM, Anton Aylward pecked at the keyboard and wrote:

On 06/09/2014 12:47 PM, lynn wrote:

...

13.1 Hi Why can't I run commands as sudo? e.g. lynn@catral:~> sudo automount -m root's password: sudo: automount: command not found Fails, but:

lynn@catral:~> su Password: hh16:/home/lynn # automount -m autofs dump map information

...works fine. Is this meant to be the default?

Probably. Sounds like a PATH problem to me.

When you do a real 'su' you get root's PATH

Not correct. you must use 'su -' to get root's $PATH. -- Ken Schneider SuSe since Version 5.2, June 1998 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/10/2014 03:21 PM, Carlos E. R. wrote:

However, IMHO it is a bug or bad programming that when you call "sudo something" it first ask you for the password, then tries to find the program, using the calling user's path.

hmm, what if the user calling sudo creates a malicious shell script with that same name as configured in /etc/sudoers, which then would be executed as the other user? I'd consider this a backdoor. I personally always specify absolute paths in the sudoers file btw. Have a nice day, Berny -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/10/2014 03:47 PM, Carlos E. R. wrote:

But you may be right, that could be the reason. I have one entry:

cer Telcontar = (news) NOPASSWD: /usr/bin/tailf /var/log/news/news.debug

Obviously "tailf" can be called as plain user, but for use with sudo I needed to input the full path.

It's the other way round: if just "tailf" would be in your sudoers without absolute path, and sudo would first try to resolve it before switching the user, then it would be possible for the local user/attacker to create another script/program with the same name (e.g. with content like "rm -rf /var/spool/news"), put it into a directory which is more at the beginning of $PATH, and then run that arbitrary stuff as user 'news'. I don't think this is wanted ... Absolute paths in sudoers are *good* (and not only there). ;-) Have a nice day, Berny -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-10 00:43, John Andersen wrote:

Which reminds me..... Why does Opensuse continue to require root's password for sudo?!!

Because you are expected to change this yourself. The config file has comments saying that it is this way on purpose, for the initial system install, and then you are expected to change it as appropriate for your system. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

* John Andersen [06-09-14 18:44]: [...]

Which reminds me..... Why does Opensuse continue to require root's password for sudo?!!

I don't run every distro, but I run a lot of them in addition to a couple BDS flavors, and OS is the only one where you have to hand out root's password to anyone who might need to do some trivial task such as automount or starting samba or some such.

I can remember when sudo was broken and this was necessary but that is a long time ago, and I see no reason for this to continue. A rational structuring of the sudo configurations would seem to long overdue so that we could get away from this like everybody else.

sudo *is* configurable. All you must do is configure it to allow what you deem necessary. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* John Andersen [06-10-14 15:35]:

On 6/9/2014 4:47 PM, Patrick Shanahan wrote:

...

...

I can remember when sudo was broken and this was necessary but that is a

...

long time ago, and I see no reason for this to continue. A rational structuring of the sudo configurations would seem to long overdue so that we could get away from this like everybody else.

...

sudo *is* configurable. All you must do is configure it to allow what you deem necessary.

Yes, I know that. I was born in the morning, Patrick, but not THIS morning.

The point is no other 'nix that I am aware of requires you go give out root's password to do a restricted set of operations by default.

nor does openSUSE, but configuring/editing /etc/sudoers *is* necessary and then root's password does not need to be exposed.

All of the others require only the user's password by default, (just add desired users to wheel).

iow, a different configuration change but still *only* requires configuration.

This sets a bad precedent. Many people might be entrusted to mount a CD on a server, or start some service like cups or restart samba or something. If you give them root's password they will simply log in as root, either at the console or via su, and avoid prefacing every command with sudo.

As it is no longer morning, you should realize that root's password does not need to be exposed, period. But "root" must properly configure the system.

Most distros set up sudo to require people be on the sudoers list AND to use their OWN password. Some make the first user account (created at at installation time) a member of wheel, and able to do all sudo functions by default, but still require only that user's password.

So everyone is *root* but must use there own password. Come on, you don't believe that is proper system configuration!

Virtually all distros require some configuration of sudo to be generally useful to a all users, but only opensuse requires roots password by default.

If *anyone* can configure sudo, root is no longer necessary.

The question is why does Opensuse stand alone in this practice?

To maintain a safe/sane environment! -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* John Andersen [06-10-14 19:41]:

On 6/10/2014 1:16 PM, Patrick Shanahan wrote:

...

...

...

Most distros set up sudo to require people be on the sudoers list AND to use their OWN password. Some make the first user account (created at at installation time) a member of wheel, and able to do all sudo functions by default, but still require only that user's password. So everyone is *root* but must use there own password. Come on, you don't believe that is proper system configuration!

That is not what I said. And you know it.

Look, Patrick, instead of arguing with me why not stop being so provincial and at least TAKE A LOOK at some other distros or OpenBSD, FreeBSD, etc.

I have and I know the difference. But the topic is openSUSE's status and I believe sudo is handled correctly and securely. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Patrick Shanahan wrote:

* John Andersen [06-10-14 15:35]:

...

On 6/9/2014 4:47 PM, Patrick Shanahan wrote:

...

...

I can remember when sudo was broken and this was necessary but that is a

...

long time ago, and I see no reason for this to continue. A rational structuring of the sudo configurations would seem to long overdue so that we could get away from this like everybody else.

...

sudo *is* configurable. All you must do is configure it to allow what you deem necessary.

Yes, I know that. I was born in the morning, Patrick, but not THIS morning.

The point is no other 'nix that I am aware of requires you go give out root's password to do a restricted set of operations by default.

nor does openSUSE, but configuring/editing /etc/sudoers *is* necessary and then root's password does not need to be exposed.

...

All of the others require only the user's password by default, (just add desired users to wheel).

iow, a different configuration change but still *only* requires configuration.

...

This sets a bad precedent. Many people might be entrusted to mount a CD on a server, or start some service like cups or restart samba or something. If you give them root's password they will simply log in as root, either at the console or via su, and avoid prefacing every command with sudo.

As it is no longer morning, you should realize that root's password does not need to be exposed, period. But "root" must properly configure the system.

...

Most distros set up sudo to require people be on the sudoers list AND to use their OWN password. Some make the first user account (created at at installation time) a member of wheel, and able to do all sudo functions by default, but still require only that user's password.

So everyone is *root* but must use there own password. Come on, you don't believe that is proper system configuration!

By default, NO login name should be in /etc/sudoers. When the admin adds a login name to /etc/sudoers, he should, likewise, list the programs (and ONLY the programs) which that user needs to be able to run as root. It is anything BUT a blank check. At least that's how it has always been configured on the Solaris, HP-UX, Irix, and other commercial unixes that I administrated in the auto industry. The point of using their own password is that 1. They (the users allowed to sudo) DON'T have the root password 2. The user is responsible for anything done, since it was THEIR OWN PASSWORD which was used to run the sudo-ed command. 3. The sudo command allows the admin to allow each user to run ONLY the precise administrative commands that they need to run, and no others. 4. If you don't want a user using sodo, then you don't put their login name in /etc/sudoers 5. Revoking one user's sudo privileges is as easy as removing their login name from /etc/sudoers, and thus NOT requiring a change to the root password. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-10 21:35, John Andersen wrote: ...

Virtually all distros require some configuration of sudo to be generally useful to a all users, but only opensuse requires roots password by default.

The question is why does Opensuse stand alone in this practice?

Because as Patrick says, root *must* configure the system. The openSUSE etc/sudoers file says: ## In the default (unconfigured) configuration, sudo asks for the root password. ## This allows use of an ordinary user account for administration of a freshly ## installed system. When configuring sudo, delete the two ## following lines: And when you do delete those lines, you have to use your own password, not root's password. In openSUSE, and previously SuSE, sudo is intentionally configured (ie, not configured) to require root's password till you do configure sudoers. If I remember right, wheel was also intentionally disabled: I read something about it related to tyranny years ago. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 11/06/14 15:23, Linda Walsh wrote:

John Andersen wrote:

...

Most distros set up sudo to require people be on the sudoers list AND to use their OWN password. Some make the first user account (created at at installation time) a member of wheel, and able to do all sudo functions by default, but still require only that user's password.

---

That's sounds weird.

I've always had to type a root password to get root-enabled -- never my own. That's not very secure -- i.e. if someone hacks my PW they get root? root's PW was another layer of security. You say most other distros are _that_ insecure?

Ouch!

One of the "most" popular distro is Ubuntu (/Kubuntu) and all you do to get things *MOST* - not all - things done is to type 'sudo <whatever-command>' followed by *your* login password and....... Bob's your Uncle, the command is executed! AND there is no configuration of any sudo-voodoo config file(s) - it's the default setting that the user can perform most root tasks by doing the above.

...

The question is why does Opensuse stand alone in this practice? Security?

But who cares about security, really? If they did nobody would be running Windows, eg. Now, of all the group of people who would be - or should be! - worried by security are corporations but how many are using Windows, eg? Worrying about security, just like global warming, is only for the nerds and similar who hide behind anything-Linux; but "real men" "don't dance" and don't use fancy stuff like Linux 'cause "he-men" prefer the excitement generated when using something like Windows! BUT the main reason for using the latter is that it is also a wealth-generating system where people are employed coming up with virus scanners etc. You get the picture. A slight change of words used by Hagrid in 'Harry Potter and the Chamber of Secrets', "Just follow the money". BC -- Over the years you've helped raise awareness of a number of issues but the main one has been what a pain in the arse you are. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/11/2014 02:08 AM, Basil Chupin wrote:

But who cares about security, really? If they did nobody would be running Windows, eg. Now, of all the group of people who would be - or should be! - worried by security are corporations but how many are using Windows, eg?

I have two computer that run Windows 7. One is set up as a two user system, administrator and myself, the other is a three user setup, Administrator, my best half and myself. Only the administrative user has any administrative privileges. In this configuration it is very much like running Linux except I have seen no kind of "sudo". You have to use the administrator password. -- Those who expect to reap the blessings of freedom must. like men, undergo the fatigue of supporting it.-Thomas Paine _ _... ..._ _ _._ ._ ..... ._.. ... .._ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-11 16:22, James Knott wrote:

On 06/11/2014 08:40 AM, Billie Walsh wrote:

...

In this configuration it is very much like running Linux except I have seen no kind of "sudo". You have to use the administrator password.

In W7, you have to provide the admin password to run admin stuff. However, there are still some things that still require you to be logged in as root.

Yes, I have some windows applications that fail as user, even if they ask for the administrator password. For instance, my android samsung phone update. I thought my phone was broken or something, and it was that blasted samsung app, not saying it needed to run as real administrator to work. What for, I can not figure out, but I guess their developers did not even bother to run as plain user, in that stupid Windows tradition of working full time as administrator.

I'm not aware of anything in Linux that can't be done with sudo and requires a root login.

No, I can't think of any. Wait, sudo? Yes, I know of a few that fail, that need instead "su -". It happens sometimes with yast, no permission to access the graphical window or something, or dbus, or something of the sort. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-11 17:39, James Knott wrote:

On 06/11/2014 11:33 AM, Carlos E. R. wrote:

...

Wait, sudo? Yes, I know of a few that fail, that need instead "su -"

I included "su -" when I referred to sudo. In fact I normally use "su -". I have yet to see it fail. I use sudo when I to be able to do something without having to provide the root password. For those, I have a special "sudo" directory, where I place a script that runs what I want.

No, sudo and "su -" have important differences in the environment they set or pass on. Sudo keeps part of the calling user environment, and erases some vars. On the other hand, "su -" sets the full "root" default environment. Some applications simply fail when used via sudo because of this. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 2014-06-11 18:20, James Knott wrote:

On 06/11/2014 11:56 AM, Carlos E. R. wrote:

...

No, sudo and "su -" have important differences in the environment they set or pass on. Sudo keeps part of the calling user environment, and erases some vars. On the other hand, "su -" sets the full "root" default environment.

"Su -" is the full root environment. "Su" is just root privilege in the user environment. I will use either, depending on what I'm doing.

Exactly. And sudo is roughly equivalent to "su" in that respect, you get no choice. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 06/12/2014 08:46 AM, Basil Chupin pecked at the keyboard and wrote:

On 12/06/14 02:20, James Knott wrote:

...

On 06/11/2014 11:56 AM, Carlos E. R. wrote:

...

No, sudo and "su -" have important differences in the environment they set or pass on. Sudo keeps part of the calling user environment, and erases some vars. On the other hand, "su -" sets the full "root" default environment. "Su -" is the full root environment. "Su" is just root privilege in the user environment. I will use either, depending on what I'm doing.

Hold onthere for a moment :-) .

What exactly is the difference in what you just stated above re "su -" and '"su" is just root privilege in the user environment"'?

If you are 'root' why would you want to use "su -" anyway?

I have found that in openSUSE when one uses "su -" - or even "su" - you are asked for the root's password and you can do whatever root is able to do with the system.

It's all about the $ENV Basil. To test this use 'su', enter roots password, and type "env" and then (after you exit using CTRL-d) use 'su -', enter root's password, and type "env". Compare the two lists and you will find many differences, chief among them will be the $PATH result. HTH -- Ken Schneider SuSe since Version 5.2, June 1998 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Basil Chupin wrote:

On 12/06/14 02:20, James Knott wrote:

...

On 06/11/2014 11:56 AM, Carlos E. R. wrote:

...

No, sudo and "su -" have important differences in the environment they set or pass on. Sudo keeps part of the calling user environment, and erases some vars. On the other hand, "su -" sets the full "root" default environment. "Su -" is the full root environment. "Su" is just root privilege in the user environment. I will use either, depending on what I'm doing.

Hold onthere for a moment :-) .

What exactly is the difference in what you just stated above re "su -" and '"su" is just root privilege in the user environment"'?

If you are 'root' why would you want to use "su -" anyway?

I have found that in openSUSE when one uses "su -" - or even "su" - you are asked for the root's password and you can do whatever root is able to do with the system.

As well, when you use "sudo <command>" you are asked for the *root's* password; whereas in something like Ubuntu you are simply asked for your *user* login password - but you *cannot* do everything which root can do.

What am I misunderstanding in this discussion?

The purpose of sudo is to allow a non-privileged user to execute a limited number of commands as root, WITHOUT giving the root password to the user. Both Ubuntu and openSuSE are set up wrong. If the user has the root password, then they can just use su, and do anything with that. That's the problem with the openSuSE configuration. If the user can do ANYTHING with sudo, then, they can do ANYTHING as root. That's the prbolem with the Ubuntu configuration.

BC

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Ruediger Meier wrote:

On Friday 13 June 2014, Dirk Gently wrote:

...

Basil Chupin wrote:

...

On 12/06/14 02:20, James Knott wrote:

...

On 06/11/2014 11:56 AM, Carlos E. R. wrote:

...

No, sudo and "su -" have important differences in the environment they set or pass on. Sudo keeps part of the calling user environment, and erases some vars. On the other hand, "su -" sets the full "root" default environment.

"Su -" is the full root environment. "Su" is just root privilege in the user environment. I will use either, depending on what I'm doing.

Hold onthere for a moment :-) .

What exactly is the difference in what you just stated above re "su -" and '"su" is just root privilege in the user environment"'?

If you are 'root' why would you want to use "su -" anyway?

I have found that in openSUSE when one uses "su -" - or even "su" - you are asked for the root's password and you can do whatever root is able to do with the system.

As well, when you use "sudo <command>" you are asked for the *root's* password; whereas in something like Ubuntu you are simply asked for your *user* login password - but you *cannot* do everything which root can do.

What am I misunderstanding in this discussion?

The purpose of sudo is to allow a non-privileged user to execute a limited number of commands as root, WITHOUT giving the root password to the user.

Both Ubuntu and openSuSE are set up wrong.

If the user has the root password, then they can just use su, and do anything with that.

Using su has the disadvantage that you need to type password for each su command. Sudo asks for pwd only once at the first time and then it's cached for some minutes.

You have su and sudo reversed. su (substitute user) will give you a shell of another user. If no user is specified, it is a root shell. sudo allows you to run one command as root.

Using su to start a interactive root shell is unwanted because of several obvious reasons.

The thing is this -- if you want a generic user to be able to mount a dvd, the last thing you want to do is give him the root password, because then he can do ANYTHING. Instead, what you want to do is edit /etc/sudoers, and add him as a n allowed user, and allow him torun the required mount and unmount command, and nothing else. You want his password for sudo to be his normal user password, NOT THE ROOT PASSWORD. If you give the users the root password for sudo, then they can just login to root, and not have to fuss with sudo at all. And then you have a non-administrator with administrative privileges. Anybody who has seen how users act when they get a little bit of admin power, they will customize the system to optimize for their own benefit, even to the detriment of all other users. Why? "Because I have root privileges and they don't -- the powers that be obviously condone me customizing the machine to my benefit and not theirs"

So IMO the password protected sudo as is the right default. How else would you like it. Allowing sudo without password for all users per default?

...

That's the problem with the openSuSE configuration.

If the user can do ANYTHING with sudo, then, they can do ANYTHING as root. That's the prbolem with the Ubuntu configuration.

...

BC

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* John Andersen [06-16-14 15:16]: [...]

Unfortunately, in almost every system, the default install allows that ONE Command to be "sudo -s" which gives you a root shell.

Only unfortunate if one has foolishly given out the root password rather than utilizing sudo as intended, specifically selecting commands for access and assigning them to a password protected group. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* John Andersen [06-19-14 06:46]:

On 6/16/2014 1:39 PM, Patrick Shanahan wrote:

...

* John Andersen [06-16-14 15:16]: [...]

...

Unfortunately, in almost every system, the default install allows that ONE Command to be "sudo -s" which gives you a root shell.

Only unfortunate if one has foolishly given out the root password rather than utilizing sudo as intended, specifically selecting commands for access and assigning them to a password protected group.

Not sure that would actually help in this case, because the -s is built into sudo. There is no specific command to be selected or excluded from execution.

First, your understanding of this is wrong. You don't need root's password to get a root shell. Even on OpenBSD, as default, you issue sudo -s and are asked for your (user) password.

Ah??? 07:01 Crash: ~ > sudo -s root's password:

If your user is in sudoers, AND the root account has a shell allowed, you get a shell, (although it won't (usually) run root's profile, nor will it necessarily offer a complete environment.

Users Hosts RunAs NOPASS Cmds ALL ALL (ALL) No ALL ALL ALL (ALL) No ALL

Not sure if there is another way to disable this feature.

I don't see that with my config or lack of config. I made no changes to sudo config, it is as it came, stock. No, root's passwd is not the same as <user> which is *not* what is suggested on install :^( My desktop is essentially a single user seat but at times others sit there but there is *no* access in any manner of root's domain w/o providing "root's" passwd. Security setting #1. And I do *not* give out root's passwd. -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

* Carlos E. R. [06-19-14 08:19]:

On 2014-06-19 13:13, Patrick Shanahan wrote:

...

* John Andersen <> [06-19-14 06:46]:

...

...

First, your understanding of this is wrong. You don't need root's password to get a root shell. Even on OpenBSD, as default, you issue sudo -s and are asked for your (user) password.

Ah??? 07:01 Crash: ~ > sudo -s root's password:

The default openSUSE (and S.u.S.E. decades before) sudo configuration, is a non-configured sudoers file, which requires root's password, on purpose.

You have to do the configuration yourself, as system administrator, and decide which users, if any, can use their own password to do root things. Till you do that, nobody can become root without root's password. Obviously.

Yes, that is exactly what I meant to convey :^) -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri http://wahoo.no-ip.org Photo Album: http://wahoo.no-ip.org/gallery2 Registered Linux User #207535 @ http://linuxcounter.net -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/13/2014 02:20 AM, Dirk Gently wrote:

The purpose of sudo is to allow a non-privileged user to execute a limited number of commands as root, WITHOUT giving the root password to the user.

The purpose of sudo is to allow the system administrator to delegate to a non-privileged user a limited number of commands by appropriate configuration

Both Ubuntu and openSuSE are set up wrong.

In that 'out of the box' they are not set up to the specific needs of any particular system, yes.

If the user has the root password, then they can just use su, and do anything with that. That's the problem with the openSuSE configuration.

That's the problem with the 'out of the box' configuration that has not been customized to specific site needs by the system administrator. Many packages, Postfix, Samba, Dovecot and more are in this category.

If the user can do ANYTHING with sudo, then, they can do ANYTHING as root. That's the prbolem with the Ubuntu configuration.

The problem is really 'learned disability' and treating the user of a single-user system as if he was a sophisticated and experienced system administrator. This 'dumbing down' was epitomised by Microsoft with MS-DOS and early Windows where the end user had sysadmin privileges simply because there was no access control. Dijkstra talks of languages such as COBOL crippling the mind. I get to wonder about the security attitudes people whose first system was MS-DOS or early Windows, sometimes. I also get to wonder about people who expect complex systems that don't have an 'idiot stick' front end[1] to be managed without specific administration and configuration. After all, what are sysadmins for if not to understand the needs of the users and make sure the system meets those needs? What was that? "BoFH"? Oh, right! []1 A car is an example of that. The mechanical, chemical, electrical and electronic complexity is immense, but kids and grandmothers can drive one. All it takes is two pedals and steering wheel. -- /"\ \ / ASCII Ribbon Campaign X Against HTML Mail / \ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-14 07:43, Basil Chupin wrote:

(The other default setting at this point is the ability for the USER to receive mail sent by the system to ROOT. This, too, I deselect.)

Wrong. Some of the tools⁽¹⁾ in the mail chain refuse to process mail sent to root, on purpose. The intention is that you can not read nor send email as root. Thus email that is sent to root has to be redirected to another user instead. After all, root should never be logged in an GUI and run a mail client, and will never see those emails. The setting "send ROOT mail to XYZ user" is an intentional security setting. (1) See procmail and postfix docs. The old sendmail did not have this limitation. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

On 14/06/14 23:44, Carlos E. R. wrote:

On 2014-06-14 07:43, Basil Chupin wrote:

...

(The other default setting at this point is the ability for the USER to receive mail sent by the system to ROOT. This, too, I deselect.) Wrong.

No, not at all :-) .

Some of the tools⁽¹⁾ in the mail chain refuse to process mail sent to root, on purpose. The intention is that you can not read nor send email as root.

Thus email that is sent to root has to be redirected to another user instead. After all, root should never be logged in an GUI and run a mail client, and will never see those emails.

The setting "send ROOT mail to XYZ user" is an intentional security setting.

I can, as User, use the "su -" command and become ROOT; then run "mc" and I can then go into the relevant directory/sub-directory (forgot which ones) and can read (F3) the e-mails (if any) the system has posted to me as ROOT :-) . No big deal, no sweat, no knickers in a knot and therefore no "wedgies" :-) .

(1) See procmail and postfix docs. The old sendmail did not have this limitation.

Procmail or postfix don't interest me - nor 99% of the other users of openSUSE. I don't even know what they are :-) . I try and look at problems from a very broad perspective: what the Joe in the street sees or wants or would like to see. I am not a nerd - and don't want to be. However, this last bit - re the e-mail - is really a non-event. What about the other 2 matters I mentioned which I consider to be much more important? BC -- Using openSUSE 13.1, KDE 4.13.1 & kernel 3.15.0-1 on a system with- AMD FX 8-core 3.6/4.2GHz processor 16GB PC14900/1866MHz Quad Channel RAM Gigabyte AMD3+ m/board; Gigabyte nVidia GTX660 GPU -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 16/06/14 04:54, Carlos E. R. wrote:

On 2014-06-15 08:12, Basil Chupin wrote:

...

On 14/06/14 23:44, Carlos E. R. wrote:

...

However, this last bit - re the e-mail - is really a non-event.

What about the other 2 matters I mentioned which I consider to be much more important? That's for others to answer if they wish. I know the facts about why the redirection of root's mail, that it is intentional, and that it is for security, you believe it or not, you agree or not. :-)

We are talking about defaults,

We are talking default setting here, as I mentioned. But let's stop here for a moment. I think I let the hare loose when I mentioned that this default setting is about E-MAIL to the ROOT. I don't think that it is e-mail at all but simple mail - ie error messages etc - which the system may send to the root/administrator and has nothing to do with E-MAIL. Because I have never ever used this default settings I don't have a clue what form this mail to the root/administrator takes. Perhaps someone who is now using this default setting could educate me (us) how this mail is seen by the User - and where (ie, Thunderbird, Kmail, whatever).

not how experienced people configure their own systems, after all. BC

-- Using openSUSE 13.1, KDE 4.13.2 & kernel 3.15.0-1 on a system with- AMD FX 8-core 3.6/4.2GHz processor 16GB PC14900/1866MHz Quad Channel RAM Gigabyte AMD3+ m/board; Gigabyte nVidia GTX660 GPU -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 16/06/14 07:45, Basil Chupin wrote:

Perhaps someone who is now using this default setting could educate me (us) how this mail is seen by the User - and where (ie, Thunderbird, Kmail, whatever).

I use it to get the results of various scripts that are run as cronjobs by root. For example, I have a python script that runs each night to tell me if my son has rsyncd any new (music) files to my machine. 1. Allow your user to receive system mail (at install time or later on in YaST) 2. Set up a new account in TB (I don't use KMail anymore, so can't comment) Bob -- Bob Williams System: Linux 3.11.10-11-desktop Distro: openSUSE 13.1 (x86_64) with KDE Development Platform: 4.13.1 Uptime: 06:00am up 1 day 6:52, 4 users, load average: 0.00, 0.01, 0.05 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Le 15/06/2014 09:57, Dirk Gently a écrit :

Carlos E. R. wrote:

...

The setting "send ROOT mail to XYZ user" is an intentional security setting.

it's simply an alias in /etc/aliases and you can keep mail for root adding \root on the same line

I don't understand why there would be any problem with root running Thunderbird.

or pine/alpine on remote server, by the way, or simply "mail". But there is a strong reason for mail reaching *also* sompe user, just in case nobody ever read root mails :-)

And if I bring the system into single-user mode to fix a problem, and root doesn't have the mail.....and I need to read system mail messages to get a grasp of the problem... where am I?

in single user mode you don't have network, but keep old mail (already received) my basic postfix configure (for my server, I ver change anything on my desktop) http://dodin.info/wiki/index.php?n=Doc.PostfixConfigure jdd -- http://www.dodin.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Dirk Gently wrote:

The purpose of sudo is to allow a non-privileged user to execute a limited number of commands as root, WITHOUT giving the root password to the user.

That is 1 application and sudo can be configured that way. It doesn't come preconfigured that way, as who would be able to make up the commands a home user is allowed to run on their own system as 'root' without them knowing the password? It doesn't make sense for OSuse.

Both Ubuntu and openSuSE are set up wrong.

---- Ubuntu seems to be setup with no security other than 'user'. I can give out user logins on my system w/o giving out root. (The users I might give out a login to are housemates... not hackers, so they wouldn't be likely to try to leverage the user password to get root access -- most of them find logging on challenging enough). -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2014-06-15 08:26, Basil Chupin wrote:

However, if one knows what to do, one can then create a ROOT with his/her own password to do "all sorts of unspeakable things to the system (ooooh!)" :-) . But how to do this is clouded in 'mystery and intrigue' and only made known by getting really pally with The High Priests :-) .

Huh? I did it myself on the only ubuntu system I touched about two minutes after sitting on the chair, without asking for help to anyone or googling it. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

Carlos E. R. wrote:

On 2014-06-11 16:22, James Knott wrote:

...

On 06/11/2014 08:40 AM, Billie Walsh wrote:

...

In this configuration it is very much like running Linux except I have seen no kind of "sudo". You have to use the administrator password.

In W7, you have to provide the admin password to run admin stuff. However, there are still some things that still require you to be logged in as root.

Yes, I have some windows applications that fail as user, even if they ask for the administrator password.

Oh yes, plenty of those. They are a testament to the skill level of the average Windows programmer, methinks. -- Per Jessen, Zürich (21.2°C) http://www.hostsuisse.com/ - virtual servers, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 11/06/14 22:40, Billie Walsh wrote:

On 06/11/2014 02:08 AM, Basil Chupin wrote:

...

But who cares about security, really? If they did nobody would be running Windows, eg. Now, of all the group of people who would be - or should be! - worried by security are corporations but how many are using Windows, eg?

I have two computer that run Windows 7. One is set up as a two user system, administrator and myself, the other is a three user setup, Administrator, my best half and myself. Only the administrative user has any administrative privileges. In this configuration it is very much like running Linux except I have seen no kind of "sudo". You have to use the administrator password.

My reference to security when mentioning Windows, and other closed systems, is bring made with a broad brush and not simply confined to the use, or not use of, "sudo" or similar. I have Windows 7 Professional installed and don't have any special settings for "Administrator" - just like I didn't have such special settings when running XP, eg, many years ago, and just like the normal "Joe in the street" doesn't do when s/he has Windows installed. YOU know about the use of Administrator access so you have consciously configured your Windows systems to use the Admin. configuration. But the "joe in the street" hasn't a clue about this. I know about it but my W7Pro is not setup to do so because I only use W7Pro once in a blue moon. But this "sudo" thing is not what I was stressing. It is the overall insecurity of W and other closed-source systems. Having said this, I know about the recent problem with SSL - meaning that even opensource is subject to containing serious boo-boos. But not like the "others" where there is a flourishing third-party business finding and then creating at a cost protection against the malware which could be done away with by the correct coding of programs. Slightly off this subject of security, but an illustration of what I am talking about re the whole scene being a money-spinner by design. Way back in the early 90s there was an upstart which produced an application to quickly and efficiently defragment an HDD with Windows partitions containing DOS/NTFS files. I cannot remember its name - possibly it was called something like Diskkeeper or some such, but I cannot remember. Anyway, it was fast and it did a bloody good job. So, MS bought this upstart for ?$$$$ and incorporated this defragmenter in its Windows s/ware. But when they did this they also emasculated it so that it became one of the most crappiest defragmenters around: slow like a turtle with arthritis. It is still used in Window 7. I tried to defragment a small partition (~60GB) using this W defragmenter and it took over 50 minutes [#]. But using another application - O&O Defrag Professional ( a German product - you reading this Oh Great PITA-you-know-who?!) a much larger partition (~100GB) with almost double the number of files was defragmented in around 15minutes. There is no incentive to "go Linux" because "Follow the money" is the mantra. (Have you seen the film The Wolf of Wall Street?) [#] And when I then used O&O Defrag to defrag this same partition after it was "defragmented" by W7 it is still had work to do to complete the defrag done by the W7 defrag. Dont' believe me? Try it yourself. DISCLAIMER: I do not have any financial, or otherwise, association with O&O Defrag, nor with any organisation or group which, nor person or persons who, is less than impressed by MS and its products. BC -- Over the years you've helped raise awareness of a number of issues but the main one has been what a pain in the arse you are. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 12/06/14 22:33, Carlos E. R. wrote:

On 2014-06-12 14:17, Basil Chupin wrote:

...

On 11/06/14 22:40, Billie Walsh wrote:

...

I have Windows 7 Professional installed and don't have any special settings for "Administrator" - just like I didn't have such special settings when running XP, eg, many years ago, and just like the normal "Joe in the street" doesn't do when s/he has Windows installed.

YOU know about the use of Administrator access so you have consciously configured your Windows systems to use the Admin. configuration. But the "joe in the street" hasn't a clue about this. Many Windows professionals do know that they should install an admin account and separate user accounts, and they do. Microsoft recommends this, but does not enforce it.

...

Slightly off this subject of security, but an illustration of what I am talking about re the whole scene being a money-spinner by design. Way back in the early 90s there was an upstart which produced an application to quickly and efficiently defragment an HDD with Windows partitions containing DOS/NTFS files. I cannot remember its name - possibly it was called something like Diskkeeper or some such, but I cannot remember. Anyway, it was fast and it did a bloody good job. So, MS bought this upstart for ?$$$$ and incorporated this defragmenter in its Windows s/ware. I thought they used the Norton or the PC-tools defragmenter, at least in MsDOS 5 or 6. I compared both and they were the same, just that the MS version had fewer options. I did not compare speed, or it was so long ago that I don't remember.

I don't recall MS having any defrag service in the system - they relied solely on 3rd-party apps like the one I mentioned (?Diskkeeper). They only introduced a defrag app after they bought (?)Diskkeeper.

I actually thought of writing my own defragmenter. I had a lot of ideas to speed it up.

So, you see it appears that W had no defragmenter which made you want to write one, right? :-) Oh, I have to clarify this: whatever defrag apps which were available at the time BEFORE (?)Diskkeeper came along WERE damn slow I remember that now that you mention it :-) .

[#] And when I then used O&O Defrag to defrag this same partition after it was "defragmented" by W7 it is still had work to do to complete the defrag done by the W7 defrag. Dont' believe me? Try it yourself. Well, when I used the Norton defragmenter, and then the PC-tools one, it found things to do. And if I then run the Norton one, it also found things to do. Order did not matter.

The reason is that each one has a different idea of how the clusters should be ordered, not that they do it badly or not.

If you are, or anyone you know, is running Windows then I suggest getting a free, 30-day evaluation, copy of O&O Defrag Professional- http://www.oo-software.com/en and try it out. There are several ways to defrag the HDD - including wiping clean the empty blocks. The quickest defrag is called STEALTH but then there others....... Best to see for yourself when you use it. But what is the most inspiring this about all this is that Linux- openSUSE - has no need for all this defragmentation of the HDD! LLL(tm)! (Translated: Long Live Linux!) BC -- Over the years you've helped raise awareness of a number of issues but the main one has been what a pain in the arse you are. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/12/2014 01:04 PM, Carlos E. R. wrote:

I do, and I can prove it. Look at the photo:

http://susepaste.org/33797941

On any win 7 or later you can go to Task Manager, then click Services tab and even though you are undoubtedly running NTFS, you will see a defragsvc as one of the services. It might be stopped, because Windows doesn't run it all the time, only during your scheduled disk defrags. And this is on the file system they promised would never need a defrag. - -- Explain again the part about rm -rf / -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlOaQ20ACgkQv7M3G5+2DLIsUACgpcPUW7BQHrOtVKJw4ytVENr0 FDoAnROOpgCbs8weVGszMZKX1Sfxz+2S =toeo -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/12/2014 08:33 AM, Carlos E. R. wrote:

I thought they used the Norton or the PC-tools defragmenter, at least in MsDOS 5 or 6. I compared both and they were the same, just that the MS version had fewer options. I did not compare speed, or it was so long ago that I don't remember.

As one who ran OS/2 with the HPFS file system, I always wondered why people should have to defrag the disk. HPFS, which, incidentally, was created by Microsoft, was fragmentation resistant, as is any decent file system. Microsoft inspired a lot of bad practices. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 06/12/2014 07:17 AM, Basil Chupin wrote:

My reference to security when mentioning Windows, and other closed systems, is bring made with a broad brush and not simply confined to the use, or not use of, "sudo" or similar.

By creating an administrative user and a user with no admin privileges it is the first line of security. The sudo comment was kind of an aide. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

lynn wrote:

On Tue, 2014-06-10 at 22:23 -0700, Linda Walsh wrote:

...

John Andersen wrote:

...

Most distros set up sudo to require people be on the sudoers list AND to use their OWN password. Some make the first user account (created at at installation time) a member of wheel, and able to do all sudo functions by default, but still require only that user's password.

---- That's sounds weird.

I've always had to type a root password to get root-enabled -- never my own. That's not very secure -- i.e. if someone hacks my PW they get root? root's PW was another layer of security. You say most other distros are _that_ insecure?

Ouch!

...

The question is why does Opensuse stand alone in this practice?

Security?

Ubuntu do that. They discourage having a root password. The first user you create is the only user who can sudo. You use the user's password.

Which is taking a good idea and making it totally stupid.

L

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org