In article ,
Dan C wrote:
> > Advising new users to enable and access a root account in Ubuntu is nuts.
>
> Yeah. Wouldn't want n00bs to have proper control over their system, or
> anything like that.
>
> Speaking of n00bs.....

You can control your system without an enabled root account.

For systems with sensitive data stored on them, it is quite common to
not enable a root account, and require all administrative access to take
place through sudo.

One reason for this is logging. If you have an enabled root account,
and multiple administrators all know the password and use it, it is
harder to keep track of who is on as root when. With sudo, you can log
who it is sudoing (and you can have the log go to a separate machine, so
you don't have to worry about the person erasing the log once they get
root via sudo). In some fields, this kind of logging is a regulator
requirement, and you can be subject to heavy fines if you do not do it.

Also, a shared root account means that when someone leaves, you have to
change the password and update everyone. That's a pain in the ass.

--
--Tim Smith

On 2008-05-27, Tim Smith wrote:
> In article ,
> Dan C wrote:
>> > Advising new users to enable and access a root account in Ubuntu is nuts.
>>
>> Yeah. Wouldn't want n00bs to have proper control over their system, or
>> anything like that.
>>
>> Speaking of n00bs.....
>
> You can control your system without an enabled root account.
>
> For systems with sensitive data stored on them, it is quite common to
> not enable a root account, and require all administrative access to take
> place through sudo.
>
> One reason for this is logging. If you have an enabled root account,
> and multiple administrators all know the password and use it, it is
> harder to keep track of who is on as root when.

the traditional approach is to not enable direct root logins, and
reuire users to either sudo or su.

> With sudo, you can log who it is sudoing (and you can have the log
> go to a separate machine, so you don't have to worry about the
> person erasing the log once they get root via sudo). In some
> fields, this kind of logging is a regulator requirement, and you can
> be subject to heavy fines if you do not do it.
>
> Also, a shared root account means that when someone leaves, you have to
> change the password and update everyone. That's a pain in the ass.
>

True.

--
Due to extreme spam originating from Google Groups, and their inattention
to spammers, I and many others block all articles originating
from Google Groups. If you want your postings to be seen by
more readers you will need to find a different means of
posting on Usenet.
http://improve-usenet.org/