7 ms·
Why linux doesn't have a "wheel" group
- jerf 16y agoIt's actually interesting to consider Stallman's point. In a way, his ideals are ultimately incompatible with shared systems. A user should have their own resources if they're going to be Free. You can't have all of shared resources, security, and total Freedom in the sense of Stallman. Application to the swing back to "cloud computing", multiuser computing's latest moniker, left as an exercise for the reader.
- gst 16y agoDon't forget that this info page was written something like 20 years ago - or even earlier. At this time security requirements where completely different than today and it was not unusual for everyone in a lab to have root access to the machines.
- calloc 16y agoLinux systems generally (the last time I ran Linux was about half a year ago) don't have any sane ulimits set up either, they allow any user to forkbomb the system into oblivion. Whereas with FreeBSD the ulimits are set up for users so that they can't take down a system with a fork bomb.
- j_baker 16y agoIf Stallman were here, I'd imagine his response would be something along the lines of "Sure, it's less practical to do things this way, but it's the right thing to do. It's not right to give other users Carte Blanche to bully others any way they please just because they have a different job title."
- denysonique 16y agoWell Gentoo Linux has the "wheel" group.
- deleted 16y ago[deleted]
- kwantam 16y agoA simpler explanation is that many Linux distributions discourage the use of su altogether in favor of sudo, which gives you finer grained control over this sort of thing than wheel ever did. In any case, if you really care, just enable pam_wheel.so in your pam configuration for su (usually /etc/pam.d/su) and be sure to add yourself to the appropriate group.
- sudonim 16y agoIronically, "sudo su" works really well if you do need to get to root. But yeah, "sudo" is a much safer practice.
- akent 16y ago"sudo -i", please!
- spc476 16y agosudo vi^Mpassword^M:shell Years ago a friend of mine asked my help in securing a Unix system with sudo. I bascially told him it was nearly impossible because there were (and still are) too many ways to escape back to a root shell with sudo, so, in my humble opinion, gives a false sense of security.
- marshray 16y agoBut as far as letting people run a root shell goes, sudo is a handy way to do it.
- chousuke 16y agoI don't think the point is "more secure" root access. Rather, sudo is just a convenient way to invoke superuser privileges only when necessary. If you need a longer session with uid 0, use sudo -i. Having a separate root login is pretty much pointless. I doubt having separate passwords helps security either, since local privilege escalation vulnerabilities are common anyway. I've used sudo to restrict root access to specific command line invocations for certain users. With due care (ie. no access to software with shell escapes) it is secure. In any case, distributions seem to be moving towards eliminating the superuser altogether in common use cases. I think advocating sudo was just the beginning.
- njharman 16y ago> limits the number of people who are able to su to root. Is irrelevant and archaic for many, many servers (99%) of ones I've worked on last 20yrs (web/internet servers vs file/print/lan type servers. The only accounts who can login and get a shell are the same set of accounts who can su root to almost every server I'm involved with.
- bostonpete 16y agoThat may be true of servers, but there are lots of uses of Linux besides servers...
- ora600 16y agoAs a database consultant I can assure you there are great many servers on which I have a user, but no ability to "su root".
- bigiain 16y agoI bet if you were an "evil database consultant", you could get yourself a root shell on _many_ of those servers with a little bit of google fu. There is a startling amount of exploitable code waiting in just about every standard OS install for anybody with regular user privileges.
- ora600 16y agoIf I was evil and suicidal I could wipe up many companies by "drop database including backup". When you have DBA access to production databases, lack of root does not stand in the way of doing evil. It does stand in the way of using message logs to troubleshoot, checking contents of /proc to determine which directory a process is running from, tuning TCP parameters to maximize data transfer rates without nagging the sysadmins, etc.
- bigiain 16y agoTrue. But a _properly evil_ non-suicidal and supremely confident evil DBA could, if they wanted too, exploit the box from a local user account, rootkit it, and tidy up after themselves to remove all trace of who did it. I suspect that's actually script-kiddy-able these days, if you know the target well enough there's probably an automated tool ready to do all that for you. (For evil-genius-DBA's bonus points for doing that via the database instead of the shell and censoring traces from the db logs too...)
- benwr 16y agoSo why allow for a root password in GNU at all? Is Stallman really saying that everyone should have root access? If you accept that there's a use for a secret root password (which, I assume, Stallman has; otherwise why write an `su` at all?), having no wheel group would seem to encourage a /single/ admin with the password, to prevent the leaking of info he mentions. Which is more tyrannous?
- Someone 16y agosu has uses even when everyone knows the root password. It allows you to run a command as a different user without logging out. I also am not sure that Stallman accepted the need for passwords at all when he wrote that text. http://en.wikipedia.org/wiki/Richard_Stallman http://en.wikipedia.org/wiki/Richard_Stallman: "When MIT's Laboratory for Computer Science (LCS) installed a password control system in 1977, Stallman found a way to decrypt the passwords and sent users messages containing their decoded password, with a suggestion to change it to the empty string (that is, no password) instead, to re-enable anonymous access to the systems"
- qntm 16y agoI'm not sure I understand Stallman's comment. He is against letting "a few of the users ... hold total power over the rest". Isn't that the whole point of a system administrator? He seems to be explicitly in favour of making it so that a leaked root password will allow any user to run riot over the system. Is he an anarchist? Or did they not have malicious users or idiots in 1984? I admittedly know almost nothing about system administration.
- hvs 16y agoFrom "Free as in Freedom: Richard Stallman's Crusade for Free Software": --- "The hackers who wrote the Incompatible Timesharing System decided that file protection was usually used by a self-styled system manager to get power over everyone else," Stallman would later explain. "They didn't want anyone to be able to get power over them that way, so they didn't implement that kind of a feature. The result was, that whenever something in the system was broken, you could always fix it." Through such vigilance, hackers managed to keep the AI Lab's machines security-free. Over at the nearby MIT Laboratory for Computer Sciences, however, security-minded faculty members won the day. The LCS installed its first password-based system in 1977. Once again, Stallman took it upon himself to correct what he saw as ethical laxity. Gaining access to the software code that controlled the password system, Stallman implanted a software command that sent out a message to any LCS user who attempted to choose a unique password. If a user entered "starfish," for example, the message came back something like: I see you chose the password "starfish." I suggest that you switch to the password "carriage return." It's much easier to type, and also it stands up to the principle that there should be no passwords.
- qntm 16y agoI can't conceive of a world where "there should be no passwords" or "keep these machines security-free" were ever serious positions held by software engineers. It's Garden of Eden thinking.
- sp332 16y agoIt wasn't a rationally-considered position, it was a reaction against the strict hierarchy and batch processing mentality of the time. (Disclaimer: everything I know about this I learned from Stephen Levy's book Hackers.) The admins of these machines would flaunt their power over the users, and were very antagonistic toward the hackers who wanted to do "cool" stuff on the computers. So, keeping the machines security-free and not allowing passwords was actually necessary to promote the idea that anyone could run a program on the computer, because that was not the status quo. The fear that someone would take control and abuse power in that way was not an unfounded one.
- deleted 16y ago[deleted]
- marshray 16y agoThis logic only makes the tiniest bit of sense if 'su' is the only way escalate privileges. Almost every real system has many ways to escalate, especially for someone who already knows the root password. telnet, sudo, X11, ftp, and last but not least, 'login'. "OK", you say "maybe all those are turned off for root". Well, even then there are likely many other accounts with some degree of privilege. Often these can be leveraged to root access. For example: the members of the wheel group.
- cagenut 16y agoIronically the "wheel" construct is alive and well via sudo. The default /etc/sudoers for rhel/centos/fedora systems has a line that allows anyone in the wheel group the ability to run anything they want through sudo, its just commented out. Delete one character and voila, you can give and retract root privs via adding and removing users from the wheel group.
- dryicerx 16y agoThe etymology of the company WheelGroup (now aquired by Cisco) makes a lot more sense now... http://en.wikipedia.org/wiki/WheelGroup http://en.wikipedia.org/wiki/WheelGroup
- bcl 16y agoThe title is incorrect on several levels. Not the least of which is that it is the distributions that determine whether to use wheel, not the Linux kernel. For example, in Fedora 15 we are now using wheel to add users as administrators who are able to sudo to root. This is easily enabled by checking the 'Administrator' box during firstboot's setup of the user account.
- doki_pen 16y agoStrange, most distros I've used do have wheel. I think it's only Debian based distros that don't.
- loulan 16y agoI've used Gentoo for years and it used the "wheel" group. Maybe it has changed now, though.
- rg3 16y agoIn my Slackware system, which does not use PAM by the way, it's perfectly possible to support the "wheel" group. In fact, the group is already present in /etc/groups and you can add users to it. Later, you don't need to change the permissions of /bin/su. The check can be run from the program itself if you edit /etc/suauth and add a line like this: root:ALL EXCEPT GROUP wheel:DENY But I think this may be due to the "su" program not being GNU su, but the one from the shadow suite. :)
- wakeup 16y agoRMS is now officially dead to me. What the fuck???
- perlgeek 16y agoNitpick about the title: "linux" is a kernel and doesn't care about how the userspace organizes its groups. It's really about GNU su.
- deleted 16y ago[deleted]