5 ms·

Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password. Linux already has RBAC - if you look in /etc/group, you will see a

by gvb 15y ago

Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password. Linux already has RBAC - if you look in /etc/group, you will see a group "lpadmin", if you are in the group, you can add/configure/delete printers (after authenticating with your user password). To the best of my knowledge, this is what Oracle is bragging about, and is equivalent to Microsoft's UAC (with Win7, they finally made it as convenient as linux).

pejoculant 15y ago
RBAC appears to be a bit richer of a concept than group based authentication. In particular, role assignments can be session dependent and role assignments can be constrained to live in a particular hierarchy. The latter is useful for situations where you want to make it possible for a user to have role A or role B but not both at once. Edit: Just to add, the key thing that they appear to be bragging about is that they use RBAC to grant the user logged into the system console the "Console User" profile which by default has permissions to modify printers and wireless connections. Once you have this role, you don't not need to authenticate further.
munin 15y ago
I love how we have surrendered the "gains" from the "unix security model". "yeah, there's a separation between root and user, but... there's only one user account ... and its password is the same as the root accounts password thanks to sudo ..."
rwl 15y ago
> Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password. This is true of Ubuntu, but not of Debian.
binarycrusader 15y ago
Linux doesn't already have RBAC. RBAC can do things Linux can't like two-man authentication for system administration (e.g. two people together can open a safe with their own keys, but not just one). https://blogs.oracle.com/gbrunett/entry/enforcing_a_two_man_rule

by gvb 15y ago

pejoculant 15y ago

RBAC appears to be a bit richer of a concept than group based authentication. In particular, role assignments can be session dependent and role assignments can be constrained to live in a particular hierarchy. The latter is useful for situations where you want to make it possible for a user to have role A or role B but not both at once. Edit: Just to add, the key thing that they appear to be bragging about is that they use RBAC to grant the user logged into the system console the "Console User" profile which by default has permissions to modify printers and wireless connections. Once you have this role, you don't not need to authenticate further.

munin 15y ago

I love how we have surrendered the "gains" from the "unix security model". "yeah, there's a separation between root and user, but... there's only one user account ... and its password is the same as the root accounts password thanks to sudo ..."

rwl 15y ago

> Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password. This is true of Ubuntu, but not of Debian.

binarycrusader 15y ago

Linux doesn't already have RBAC. RBAC can do things Linux can't like two-man authentication for system administration (e.g. two people together can open a safe with their own keys, but not just one). https://blogs.oracle.com/gbrunett/entry/enforcing_a_two_man_rule