On Wed, 2012-02-29 at 14:56 -0500, James Knott wrote: Add to that limiting network broadcasts to root. Lots of software uses this method to locate devices. For us this includes GigE Vision cameras, network lasers, and a host of measurement transducers. Being root for this has been a real PITA. -- Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Kim Leyendecker wrote:

Then I'd go with creating a request on openFATE or discuss it on factory (afaik it is already). On the other hand, I've seen three threads about this issue so far, just wondering, would this also get so much attention if I would rant about this instead of Linus?

I was aware of this issue before I read his comments. I have provided computer support in the corporate world and cannot imagine why anyone would decide requiring root password for WiFi was a good idea. In the corporate world, users do not generally get the root or admin password. This means they cannot take their notebook computer from work and use WiFi anywhere else, if that password is required. In the past couple of months, I have stayed at three hotels and used the hotel WiFi. If I needed admin password (the computer I was given runs Windows) to connect to the hotel's WiFi, I could not have had Internet access, which I required to do my work. This clearly illustrates why root password must not be mandatory. Make it optional if needed, but never manadatory. As for adding printers, how many people bring their work computers home and connect to their own printers? Again, with this insurance company project, I am expected to go to a site and connect to the local printer. How can I do that without the root (admin) password? I might allow time zone, as that can affect file access times, which can become a security issue. However, since Linux uses UTC (GMT) for file times, this issue only affects what the user sees on the computer and nothing else. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wednesday 29 February 2012 15:20:19 James Knott wrote:

Kim Leyendecker wrote:

...

Then I'd go with creating a request on openFATE or discuss it on factory (afaik it is already). On the other hand, I've seen three threads about this issue so far, just wondering, would this also get so much attention if I would rant about this instead of Linus?

I was aware of this issue before I read his comments. I have provided computer support in the corporate world and cannot imagine why anyone would decide requiring root password for WiFi was a good idea.

I don't understand this issue - I've never been asked a password for WiFi on openSUSE... NetworkManager doesn't do that, afaik. Or is this a GNOME Shell issue?

In the corporate world, users do not generally get the root or admin password. This means they cannot take their notebook computer from work and use WiFi anywhere else, if that password is required. In the past couple of months, I have stayed at three hotels and used the hotel WiFi. If I needed admin password (the computer I was given runs Windows) to connect to the hotel's WiFi, I could not have had Internet access, which I required to do my work. This clearly illustrates why root password must not be mandatory. Make it optional if needed, but never manadatory. As for adding printers, how many people bring their work computers home and connect to their own printers? Again, with this insurance company project, I am expected to go to a site and connect to the local printer. How can I do that without the root (admin) password?

As I wrote before, the problem afaik was that the printer didn't have a driver installed. Installing drivers requires root password, installing a printer for which drivers are present does not. Afaik. I don't remember installing printers, I usually just connect the cable and the printer shows up in KDE application print dialogs...

I might allow time zone, as that can affect file access times, which can become a security issue. However, since Linux uses UTC (GMT) for file times, this issue only affects what the user sees on the computer and nothing else.

Changing the CLOCK TIMEZONE or the desktop timezone should not require a root password. It doesn't, in GNOME 2, XFCE, LXDE and KDE. In GNOME Shell 3.2 this was simply not implemented very well yet. Should be fixed in 3.4.

Jos Poortvliet wrote:

Changing the CLOCK TIMEZONE or the desktop timezone should not require a root password.

It does in 12.1. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 29/03/12 17:06, Marcus Meissner wrote:

...

Jos Poortvliet wrote:

...

Changing the CLOCK TIMEZONE or the desktop timezone should not require a root password. It does in 12.1. The problem here was that the applet had timezone and time change as same

On Wed, Mar 28, 2012 at 09:35:47PM -0400, James Knott wrote: privilege and not as split privileges.

timezone changes basically are allowable for users, but time changes are "bad" as they void logfile integrity.

This is GNOME 3 specific and Vincent opened a upstream bug already to split them again.

Ciao, Marcus

I guess that this may be an opportune time to introduce the suggestion that perhaps there should be 2 separate mail list for general HELP: one titled KDE and the other GNOME. The other alternative is to ask people to always mention that they are using Gnome and that their question is do with the Gnome DE because most of the people in this list are KDE users and therefore always incorrectly assume that the question is to do with KDE and not Gnome. I know that there is a Gnome list as well as a KDE list but people have been conditioned to regard them as lists to talk about "development" problems about "yet to be released stuff" in Factory and Kernel. BC -- Why isn't there mouse-flavoured cat food? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 3/29/2012 2:36 AM, Basil Chupin wrote:

most of the people in this list are KDE users

That's fascinating. How do you divine this? -- bkw -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 01/04/12 10:41, Sven Burmeister wrote:

...

On 3/29/2012 2:36 AM, Basil Chupin wrote:

...

most of the people in this list are KDE users That's fascinating. How do you divine this? Simply by assuming the same statistical distribution applies to this list and

Am Samstag, 31. M�rz 2012, 19:18:42 schrieb Brian K. White: the distro.

KDE is the most often used DE among oS users and hence most users on this list are assumed to use KDE. The former was measured some time ago.

Sven Just in support of this:

http://www.muktware.com/survey/3444/poll-which-de-you-use BC -- Why isn't there mouse-flavoured cat food? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 04/01/2012 02:41 AM, Sven Burmeister wrote:

Am Samstag, 31. März 2012, 19:18:42 schrieb Brian K. White:

...

On 3/29/2012 2:36 AM, Basil Chupin wrote:

...

most of the people in this list are KDE users

That's fascinating. How do you divine this?

Simply by assuming the same statistical distribution applies to this list and the distro.

KDE is the most often used DE among oS users and hence most users on this list are assumed to use KDE. The former was measured some time ago.

Btw. Have a look at these numbers: http://news.opensuse.org/2011/11/19/opensuse-12-1-launch-feedback/ Andreas -- Andreas Jaeger aj@{suse.com,opensuse.org} Twitter/Identica: jaegerandi SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Jeff Hawn,Jennifer Guild,Felix Imendörffer,HRB16746 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Monday, April 02, 2012 13:51:24 Carlos E. R. wrote:

On 2012-04-02 08:37, Andreas Jaeger wrote:

...

On 04/01/2012 02:41 AM, Sven Burmeister wrote:

Btw. Have a look at these numbers:

http://news.opensuse.org/2011/11/19/opensuse-12-1-launch-feedback/

GNOME-LiveCD: 7392 KDE-LiveCD: 5561

So, most users are gnome users, not kde :-)

Yep, if you only cite some numbers and leave out the others, this is a perfect reasoning. Those are the 32-bit numbers. 64-bit x86-64 numbers: GNOME-LiveCD: 4031 KDE-LiveCD: 4378 Andreas -- Andreas Jaeger aj@{suse.com,opensuse.org} Twitter/Identica: jaegerandi SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Jeff Hawn,Jennifer Guild,Felix Imendörffer,HRB16746 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-04-02 14:43, Will Stephenson wrote:

A priori, the higher number of GNOME i586 LiveCD downloads can be explained by our users' curiosity about the first openSUSE with a stable GNOME 3 on it, since this was the headline item in our release publicity, and (factoring out ethnic rivalries) the most interesting thing about 12.1.

It is possible. I would be curious about the numbers if 11.2 also offered CDs for other desktops.

I would like to point out that we should be able to do a lot better than 90000 downloads total in the first 24 hours and quibbling about the desktop share of a four-figure fraction of that is a pitiful waste of this community's time, which would be better invested in making release publicity for 12.2, building up grassroots promotion channels and, dare I say it, engineering.

Indeed :-) - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk95oTgACgkQIvFNjefEBxp6pwCfYfYGJb4n4jeYp0YoPshxNa5y B2MAoMq4WY8m1URJnozBg20g/6mW9L3Y =mjYp -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Mon, 2012-04-02 at 13:51 +0200, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-04-02 08:37, Andreas Jaeger wrote:

...

On 04/01/2012 02:41 AM, Sven Burmeister wrote:

...

Btw. Have a look at these numbers:

http://news.opensuse.org/2011/11/19/opensuse-12-1-launch-feedback/

GNOME-LiveCD: 7392 KDE-LiveCD: 5561

So, most users are gnome users, not kde :-)

Or, First they downloaded and burned the image to CD, After booting it, they come to the conclusion, that something must have gne wrong during the download, so they download it again, and again... But the quality doesn't improve ;-))) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Rajko M. wrote:

...

It does in 12.1. Not in KDE and default clock plasmoid. As a matter of fact you can cover desktop with clocks, one for each time zone.

In other words don't generalize behavior of your favorite desktop.

If you are not happy, it was your choice.

KDE4 on 12.1. Right click on clock, select "Adjust Date and Time", try to change time zone without root password. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-02-29 20:56, James Knott wrote:

...

he names these:

Time Zone changes

You can change the timezone as user via CLI.

Certainly WiFi should be done by uses, unless a company wants to send a tech along with employees to hotels, coffee shops etc.

I worked for a company where wifi was strictly forbidden (they also employed antitempest windows). The issue was that wep encryption was weak. Now there is stronger encryption, but I don't see them allowing their employees to freely connect anywhere with the risk of choosing a nonencripted AP. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk9OkvkACgkQIvFNjefEBxq0uQCeNmK+b9WI7fnDZnUsE2RIc8bq 26oAn34PRLrXGY//YbjZ+4NNDVNE/C39 =dzbf -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, 2012-02-29 at 15:22 -0500, Robert Schweikert wrote:

On 02/29/2012 03:13 PM, jdd wrote:

...

Le 29/02/2012 20:40, Larry Stotler a écrit :

...

As many are aware, Linus Torvalds has started a rant about the security policies

what about give sudo rights to his daugther?

That was one of the suggestions in the google+ comments.

sudo has the huge disadvantage that it opens up too much. The app can do anything root can, when perhaps it is a limited thing you want to allow. I think the issue is fine-grained permissions. -- Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-02-29 21:34, Patrick Shanahan wrote:

* Roger Oberholtzer [02-29-12 15:28]:

No, sudo can only do that which root has allowed exceptions for sudo-user within /etc/sudoers. It can be very specific or widely general. Exceptions *can* be set for controlling the printer, installing software, connecting to wireless/wired access points, ..............

True enough - but it is not simple, and impractical for a GUI. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk9OlCAACgkQIvFNjefEBxrSMgCfWPgVuftW/HTlDqxhTtUkccq4 y70An0flQbgO7fGJ+Uqt7OjhABwbDoI+ =jTaH -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Robert Schweikert wrote:

On 02/29/2012 03:13 PM, jdd wrote:

...

Le 29/02/2012 20:40, Larry Stotler a écrit :

...

As many are aware, Linus Torvalds has started a rant about the security policies

what about give sudo rights to his daugther?

That was one of the suggestions in the google+ comments.

I would expect he would know about that. However, if that's buried in network manager, then sudo might not be suitable. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2/29/2012 6:49 PM, Carlos E. R. wrote:

It is not simple. It requires that sudoers be configured in a certain way (quite different than the current default as shipped) and then the network manager (or printer config or whatever) has to be implemented in a certain way.

Sudo is an antique delegation method, not well suited for current day graphical apps.

- -- Cheers / Saludos,

Well said. A mess to set up too. The current YAST configuration utility seems overly obtuse in an attempt to be capable of doing everything. A simpler check box list of tasks would be easier to set up. -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 02/29/2012 07:12 PM, Carlos E. R. wrote:

On 2012-03-01 04:03, John Andersen wrote:

...

On 2/29/2012 6:49 PM, Carlos E. R. wrote:

...

A mess to set up too. The current YAST configuration utility seems overly obtuse in an attempt to be capable of doing everything. A simpler check box list of tasks would be easier to set up.

But that is complex to create. What tool do we have that allows that usage? I don't know, perhaps it is policy kit.

Well, there are a few things that a user would commonly need to do. Some of these are already mentioned on this thread, printers wifi apply security updates certain connections to Windows networks maybe some mounting issues for odd things, phones, etc Run full Yast... maybe 4 or 5 things I haven't thought of... So you have a few things like this on a Yast page Named Common SUDO tasks, and you select the user, then check the items that user should get to use. Typically you'd give a young kid the ability to only to hook up to wifi, Maybe add a printer Then as they get older you allow them to apply updates Maybe run yast. So instead of being something so open ended as the current Yast SUDO setup, it would be much simpler. You could add tasks to the list using /etc/sysconfig if needed. The use case I see for this is more likely aimed at the corporate laptop, where you don't really want to bug the IT department every time there is a security patch to apply. -- Explain again the part about rm -rf / -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

jdd wrote:

the printer case can become a problem. Do you know many present printers (including extremely cheap one) have internet access? it's even possible to print at home from a remote location.

security nightmare

Security nightmare vs being able to do one's work. As I mentioned in another note, I am expected to go to various sites and use the local printer. A bit hard to do if I require root or admin password to do it. Many others take their computers home and use their own printers and WiFi. Should they tell their boss "Sorry I can't use my computer, because I need a password to use a printer and WiFi"? By all means, make it an option that's even turned on by default, but allow root to set it to what's required. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Marcus Meissner wrote:

...

By all means, make it an option that's even turned on by default, but

...

allow root to set it to what's required. read my email.

???? I haven't seen any other email from you on this. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thursday 01 Mar 2012 00:17:20 jdd wrote:

Le 29/02/2012 21:25, James Knott a écrit :

...

and WiFi. Should they tell their boss "Sorry I can't use my computer, because I need a password to use a printer and WiFi"?

yes. and add give me a simple way to do the task: give me sudo printer group access

jdd

jdd, Off topic question here. What email client are you using? Its just that every time you reply to the same subject, it starts a new thread in my kmail. I posted a question to KDEPIM about threading last week and asked why it doesn't always work. They said that some clients don't obey all the rules regarding information put into the email headers. regards Ian -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 01 Mar 2012 21:14:55 ianseeks wrote:

On Thursday 01 Mar 2012 00:17:20 jdd wrote:

...

...

Off topic question here. What email client are you using? Its just that every time you reply to the same subject, it starts a new thread in my kmail. ...

Threading of jdd's messages is OK in my kmail (1.13.6). -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, Mar 01, 2012 at 12:17:20AM +0100, jdd wrote:

Le 29/02/2012 21:25, James Knott a écrit :

...

and WiFi. Should they tell their boss "Sorry I can't use my computer, because I need a password to use a printer and WiFi"?

yes. and add give me a simple way to do the task: give me sudo printer group access

Or edit the policy kit rights.... Ciao, Marcus -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Feb 29, 2012 at 01:34:14PM -0800, John Andersen wrote:

On 2/29/2012 1:14 PM, Marcus Meissner wrote:

...

On Wed, Feb 29, 2012 at 02:40:13PM -0500, Larry Stotler wrote:

...

As many are aware, Linus Torvalds has started a rant about the security policies in openSUSE for things that require the root password. From his Google+ post(https://plus.google.com/102150693225130002912/posts/1vyfmNCYpi5), he names these:

Time Zone changes Adding a Printer Adding a wireless network.

Now, I don't usually see the wireless issue because KNetworkmanager in KDE3(which I use) has never asked the root password for adding a new network.

While at 37, I've never changed timezones(I lead a boring life) I would have to agree that having to use the root password for this would be annoying if I needed to change it because of a flight or something.

I've worked with Linus on a hardware issue years ago, and I think we should probably at least consider reviewing the policies if they do need changed.

He should stop asking us to commit suicide first.

Ciao, Marcus

I think the entire point here is that the multi-user security model is not a good fit for a single user device like a laptop.

For single user devices, permissions should really focus on preventing the user from destroying the system or letting it be compromised by others, but in other ways, allow them to do typical administrative tasks like add printers, wifi networks, removable storage, etc.

I don't think you can dismiss Torvalds with a one-liner and come off looking anything but petty.

read my other mail. Ciao, Marcus -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, 29 Feb 2012 22:14:09 +0100, Marcus Meissner wrote:

...

I've worked with Linus on a hardware issue years ago, and I think we should probably at least consider reviewing the policies if they do need changed.

He should stop asking us to commit suicide first.

Clearly he was frustrated in his experience. He ran into a problem, tried to get it addressed (apparently), and got frustrated with pushback he got (I've not read the relevant bug, so I'm inferring that from his comment on G+). Just because he expressed himself poorly doesn't mean he doesn't have a valid point, Marcus. We shouldn't ignore the point just because it was poorly expressed. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 01 Mar 2012 00:23:02 +0100, jdd wrote:

did somebody yet notice that default install is with root passwd identical to user passwd?

Identical to the initial user password. On multiuser systems, the user passwords aren't all valid for root, obviously. :) Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 01 Mar 2012 09:21:46 +0100, jdd wrote:

Le 01/03/2012 00:33, Jim Henderson a écrit :

...

On Thu, 01 Mar 2012 00:23:02 +0100, jdd wrote:

...

did somebody yet notice that default install is with root passwd identical to user passwd?

Identical to the initial user password. On multiuser systems, the user passwords aren't all valid for root, obviously. :)

Jim

je use case was single user (linus daughter)

Sure, but in terms of overall security policy, single user isn't the only use case to be considered. Jim -- Jim Henderson Please keep on-topic replies on the list so everyone benefits -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Feb 29, 2012 at 3:37 PM, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On 2012-03-01 00:23, jdd wrote:

...

did somebody yet notice that default install is with root passwd identical to user passwd?

sure I never let this go through, but this solve definitively the problem

Nope, that's the user that did the system setup and he is also the root, with same password or different. He will not give the root password to the rest of users. It is those users who have problems.

And is no different in Windows, by the way.

- -- Cheers / Saludos,

               Carlos E. R.                (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk9OtrwACgkQIvFNjefEBxrWfgCgvVB1RhWjKCwgEeAyBeDpq7vr IxwAoLjHsexEUNzx/sAKFU4k93aWqsXj =T7lb -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

This is easily configured the traditional way during set up. My single user system has user and root passwords. -- ____________ Steven L Hess ARS KC6KGE DM05gd22 Skype user flamebait Cell 661 487 0357 (Facetime) Google Voice 661 769 6201 openSUSE  Linux 12.1 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-03-01 03:57, James Knott wrote:

Steven Hess wrote:

As I mentioned, I was given a computer for use on an insurance company's network. It runs Windows 7 and I can use it with WiFi and connecting to new printers. If I had been given a computer running openSUSE 12.1, I would not be able to do my work.

I can configure that Windows machine so that you can not do any of that. It is in fact the default config. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk9O5mIACgkQIvFNjefEBxoUZgCdFq+qkjbN4dTwTW+vcupDfUxg Jf8AoMEhCymTEjidD1iPflJpKbmhO87r =9hD+ -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-03-01 04:11, James Knott wrote:

Carlos E. R. wrote:

...

I can configure that Windows machine so that you can not do any of that. It is in fact the default config.

I have never needed admin password to use WiFi in Windows.

Because you are already the administrator. In my windows machine I can't setup the wifi network or printer. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iEYEARECAAYFAk9O6YcACgkQIvFNjefEBxpS4wCgq96kJNduvuA/WcOB68vra7JF NHoAmwcGvB/P5ivlzZzFR0z84yh/TDWk =cuM/ -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos E. R. wrote:

...

I have never needed admin password to use WiFi in Windows. Because you are already the administrator. In my windows machine I can't setup the wifi network or printer.

Please read my other note, where I said I run as a user, with separate admin account. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, 2012-02-29 at 21:53 -0500, James Knott wrote:

jdd wrote:

...

did somebody yet notice that default install is with root passwd identical to user passwd?

sure I never let this go through, but this solve definitively the problem

jdd

How does it solve the problem if an employer doesn't want to give employees root access, but expects them you be able to use WiFi?

Hmm. I use WiFi in three offices, hotels, home, and wherever. On KDE I set it up via network manager. I am never root for that. Same with wired connections. I think the problem is that network manager seems to have gone through a bad stretch where it could, in some updates, stop working. That, for wifi on openSUSE, is the issue. I do not know if the gnome equivalent has had such a seemingly turbulent recent history. Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 2012-03-01 at 07:59 -0500, James Knott wrote:

Roger Oberholtzer wrote:

...

...

How does it solve the problem if an employer doesn't want to give

...

employees root access, but expects them you be able to use WiFi? Hmm. I use WiFi in three offices, hotels, home, and wherever. On KDE I set it up via network manager. I am never root for that. Same with wired connections. I think the problem is that network manager seems to have gone through a bad stretch where it could, in some updates, stop working. That, for wifi on openSUSE, is the issue. I do not know if the gnome equivalent has had such a seemingly turbulent recent history.

In 12.1, you need root password to initially configure a WiFi connection. Once that's done, you can use it without root password. Earlier versions did not require root password to establish a connection.

Do you mean in YaST where you say you want it to be managed by ifup or by the user? Isn't that selectable when the OS in initially installed? If the installer person selects that it is to be controlled by the user, then that is that. We do our installs from OEM images we create with KIWI. There we have set the defaults so the installer person does not even have to get it right. But in the standard openSUSE installer, I really think this is available. I may be wrong. Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 2012-03-01 at 08:35 -0500, James Knott wrote:

Roger Oberholtzer wrote:

...

Do you mean in YaST where you say you want it to be managed by ifup or by the user? Isn't that selectable when the OS in initially installed? If the installer person selects that it is to be controlled by the user, then that is that.

The KDE network manager requires root password to configure a WiFi conntection. This means that when I try to use a new WiFi access point, I have to create the connection with the root password. On my own computer, this is not an issue, as I know the root password. In a corporate environment, it's a killer.

I have to check this at home tonight. Perhaps I whip out the root password without thinking. (Great security, that). But my feeling is that root access is only needed to set a new wireless interface (the bits in the laptop) to be ifup or user managed. After that, if user access was selected, the interface can connect to new access points under user control. Hmm. Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Thu, 2012-03-01 at 14:46 +0000, Dave Howorth wrote:

Jim Henderson wrote:

...

On Wed, 29 Feb 2012 22:14:09 +0100, Marcus Meissner wrote:

...

...

I've worked with Linus on a hardware issue years ago, and I think we should probably at least consider reviewing the policies if they do need changed. He should stop asking us to commit suicide first.

Just because he expressed himself poorly doesn't mean he doesn't have a valid point, Marcus. We shouldn't ignore the point just because it was poorly expressed.

I think there may be a cultural issue here. If Linus and Marcus worked for a European company, Linus would be open to a disiplinary offence of harrassment.

Luckily for Linus such things never happen in the far less bureaucratic US (where he is working) ;)

Marcus didn't ignore Linus' point. He simply asked to be treated with respect.

Although they say you attract more flies with honey than with vinegar, you collect even more with s**t. Hard to predict what gets any task done. Yours sincerely, Roger Oberholtzer OPQ Systems / Ramböll RST Office: Int +46 10-615 60 20 Mobile: Int +46 70-815 1696 roger.oberholtzer@ramboll.se ________________________________________ Ramböll Sverige AB Krukmakargatan 21 P.O. Box 17009 SE-104 62 Stockholm, Sweden www.rambollrst.se -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Hello List, Am 29.02.2012 22:23, schrieb Marcus Meissner: [...]

Hi,

Let me address in the points

[...]

- adding a printer

As it is already: * Adding a known USB printer : No popup, no query ... the printer will just start to work.

* Adding a Network printer: depending on the computers "networked printer browsing" setup, will just work without interaction.

* Adding a new not yet known printer: Difficult.

If you even need a PPD file to set it up, or an external driver, allowing this is the equivalent of giving out root access.

=> Setting up printers is a hard task, and root privilege escalation is usually easy when you are allowed to do it.

(I would also like to see it done on Windows 7 without Admin Password.)

[...] I have not jet searched for the other 'points'/'poorly expressed' wishes of the frustrated father in his last monthly/half-yearly ranting but there is a tread opened by an other user on printer/CUPS and rights management on the forum that is meant for features and changes to the distribution/project: openFATE #313287 Allow printer add and modification to users https://features.opensuse.org/313287 Regards Martin -- openSUSE profile: https://users.opensuse.org/show/pistazienfresser Martin Seidler KIRCHSTR. 11, 65843 SULZBACH (TAUNUS) FON (priv.): +49 6196 40 20 283 Ø FON (comm.): +49 6196 59 236 23 Ø FAX: +49 6196 59 236 24 Ø -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Sun, Mar 18, 2012 at 04:58:11PM +0100, Martin Seidler wrote:

Am 29.02.2012 22:23, schrieb Marcus Meissner: [...]

...

Hi,

Let me address in the points

[...]

...

- NetworkManager

12.1 shipped with 0.9 NetworkManager which was very fresh off the press.

Before 0.9 all WLAN connections were "user" based connections and did not change the system.

0.9 features now "system" and "user" based connections.

The default is "system" connections, it was not even possible to select the "user" option. A "system" connection is too deep and should only be configurable by root in our eyes.

Sadly, the UI frontends did not offer the selection to select "user" profiles, so it was necessary.

Ludwig did quite some work on making the default more sane and it works now at Linus acceptance level I think.

=> NetworkManager and NM UI tools design issues make a secure and usable default hard.

I do not know if I understood it the right way but to me that 'point' and the (possible?/wanted?) solution looks very alike to:

openFATE #305657 finer grained PolicyKit support for Networkmanager https://features.opensuse.org/305657

This is a bit different... We have started an effort to review such usecases internally now between Andreas Jaeger and the security team. Ciao, Marcus -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Jos Poortvliet wrote:

They are being reconsidered. Heck, some have been changed already, and others might. Also, Linus is not always right - some of the things he complained about were not oS' fault but GNOME Shell (which can't decouple changing timezones for the clock of a single user vs from changing time systemwide) and lacking printer drivers (if you don't have the printer driver you need a root password to install one).

He was certainly right about the Wifi and printer config. Just today, I was at a customer site and had to set up my computer to use their printer. I couldn't have done it as a mere mortal user with openSUSE 12.1. I could as a regular user in Windows. I have expressed my opinion on WiFi earlier. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 03/28/12 19:55, Robert Schweikert pecked at the keyboard and wrote:

On 03/28/2012 07:04 PM, James Knott wrote:

...

Jos Poortvliet wrote:

...

They are being reconsidered. Heck, some have been changed already, and others might. Also, Linus is not always right - some of the things he complained about were not oS' fault but GNOME Shell (which can't decouple changing timezones for the clock of a single user vs from changing time systemwide) and lacking printer drivers (if you don't have the printer driver you need a root password to install one).

He was certainly right about the Wifi and printer config. Just today, I was at a customer site and had to set up my computer to use their printer. I couldn't have done it as a mere mortal user with openSUSE 12.1. I could as a regular user in Windows.

What if the appropriate printer driver isn't already on the system? Are you implying that you are OK with installing printer driver packages as user? IMHO a lot of people will have an issue with that. How do you then differentiate the printer driver package form other packages?

I am not saying there may not be an issue. But, just saying users should be able to configure any printer simplifies things just a tat too much.

WiFi is different as the firmware package for the machine will be pulled in at install time, no additional install needed later.

Later, Robert

And in the case of a "printer driver" it usually means nothing more then supplying a PPD file to the config setup. Just how fracking paranoid are we getting? -- Ken Schneider SuSe since Version 5.2, June 1998 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org