Monday, February 5, 2007

Why do we sudo in Ubuntu, and who is Charlie Root?

It is a tradition in Linux and other Unix-like operating systems to have a superuser account named root. root is named such because "he" has full access to everything in the filesystem from the root directory "/" on down the line (whereas most ordinary users only have limited access with full access in their home directory alone.) root has a home directory too, named after himself, found at /root, not to be confused with "/" which is also called the root directory. :-) You'll notice that on most systems his home directory is not in the same place as the other user's home directories (usually /home/yourname).

In some Linux distributions, you log in to the root account frequently to perform administrative tasks on the machine, but in Ubuntu and a few other modern distros, this is not the case. Instead, we use a tool called sudo.

sudo means "switch user and do." There is another command called su (switch user), which can be used to switch to another user and open a shell, which is great if you know their password (which su prompts for), but on Ubuntu you aren't supposed to know the root password. That's right, that is how it is designed, and you should not change it unless you have a really good idea of what you are doing. The reason you don't know the root password on Ubuntu is that you don't need it at all because the admin group to which all "Administrator" users belong is listed in the sudoers list (/etc/sudoers) If I needed to change the owner of a file (hypothetically called myfile), and I need root access in order to do this, I would type:

sudo chown jeffd myfile

I will be prompted for a password. This is not the root password, but your own password. It is requested as a security precaution before proceeding to run the program with root access. After entering the password, the command "chown jeffd myfile" is executed as root, after which control returns to your ordinary user (subsequent commands are not executed as root, although if you sudo again within about five minutes, the Ubuntu defaults are set to not ask you for the password again.)

So what if you need to do several commands as root? In all the other Linuces, you just log into a shell as root. Well, if you really want to do this, you can either type sudo bash (to open the bash shell) or sudo su root (to open root's default shell). Either way, you will enter your own password and then be presented with a root shell prompt. When you are done with the shell prompt, type exit to return to your own shell. Do not forget this step! It is never a good idea to run applications or compile things as root. You should perform these tasks as your own user. In fact, some newer Linux software is designed so that it will actually refuse to compile or run as root, giving you a gentle slap on the wrist.

Again, please do not change the root password. Doing this will only weaken the security of your system, and make it easier for you to get into bad administrative habits.

If you are using gnome and would like to launch a graphical application as root you use gksudo instead of sudo, but it works the same way aside from its name and the way that the password prompt appears in a window.

Oh, one last thing: I mentioned Charlie Root in the subject. This is the full name sometimes given to the root user, when a first and last name are required (for example, in the address headers of administrative emails automatically generated by the system and sent to the root account.) I think this name is only used on BSD Unix systems, (FreeBSD, OpenBSD, and NetBSD), so you may not ever see it in Ubuntu, but because I was familiar with administering FreeBSD servers, it is still the name I affectionately call the root user by. Here's some more Charlie Root trivia.

No comments: