Hello All,
This month's LFY magazine has a Ubuntu 5.10 live CD that can be used as a live sample of the Ubuntu 5.10 OS. It installed and setup smoothly. The system was P4 2.4 GHz, Intel 845 GEBV2 MB, 256 MB RAM, 80 GB IDE HDD.
The display drivers were much better than 5.04 and gave good screen resolution unlike 5.04's basic 640x480 resolution. Sound could not be tested as multimedia was not complete due to legal issues :-P . Due to the dhcp now working in linux too, the triband ADSL modem got the system on the net as soon as it was up. The firewall inside the modem took care of open ports in the live system. The wvdial.conf file from my other distros was simply copied and run. It ran smoothly for both, the dialup modem as well as the Reliance LSP350R. Only thing to remember is that all root based commands must be preceeded by the word 'sudo'. And after the first run of the triband internet, switch off the adsl modem and after any of the wvdial connections are up, run the 'sudo route add default ppp0' command for net access. The transcend 512 mb pen drive was detected flawlessly and a cute little icon was automatically created on the desktop.
On the whole it was a very good experience and this distro came out in flying colours. It is definately worth a try. :)
My only query is that if root access is not allowed for security, still anyone can simply sudo and gain access. How is the system protected from outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
Regards,
Rony.
___________________________________________________________ How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com
On 12/5/05, Rony Bill ronbillypop@yahoo.co.uk wrote:
My only query is that if root access is not allowed for security, still anyone can simply sudo and gain access. How is the system protected from outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
Anyone cant sudo! When you create an account during the setup, you are creating an account that the will have the root previleges. That is the reason you are not asked the password for the root user when you use sudo. To change the root password you can use 'passwd root' and then try. It should ask you for the root password whenever you use sudo.
-- Regards, Sanket Medhi.
On Monday 05 December 2005 22:12, Sanket Medhi wrote:
On 12/5/05, Rony Bill ronbillypop@yahoo.co.uk wrote:
My only query is that if root access is not allowed for security, still anyone can simply sudo and gain access. How is the system protected from outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
Anyone cant sudo! When you create an account during the setup, you are creating an account that the will have the root previleges. That is the reason you are not asked the password for the root user when you use sudo. To change the root password you can use 'passwd root' and then try. It should ask you for the root password whenever you use sudo.
-- Regards, Sanket Medhi.
A question.
Say someone cracks into my system by using a user's password. So now obviously, the cracker has the password that will be asked when he executes sudo something as that user. Doesn't he have full access to the system?
Mrugesh
On Tue, Dec 06, 2005 at 10:54:22AM +0530, Mrugesh Karnik wrote:
Say someone cracks into my system by using a user's password. So now obviously, the cracker has the password that will be asked when he executes sudo something as that user. Doesn't he have full access to the system?
A) Usually systems aren't compromised through passwords, but through (for example) a badly set up CGI script.
B) You don't give blanket sudo to someone who has bad passwords.
C) You don't give blanket sudo to *anyone* (though we all do, right?)
On 12/5/05, Rony Bill ronbillypop@yahoo.co.uk wrote:
Hello All,
My only query is that if root access is not allowed for security, still anyone can simply sudo and gain access. How is the system protected from outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
Since Ubuntu is aimed primarily at desktop systems the developers must have thought of making it easier for users to access root options through sudo. You have the security of not deleing important files accidentally and at the same time you have access to all options with sudo.
Also, Its just about as secure having sudo without a root account as having sudo installed with root account. Infact if a root account is present then a novice user will be sorely tempted to log in as root all the time as then he doesn't have to worry about those nagging "Permission Denied" errors.
I for one (disclaimer: personal view only) liked the "root completely disabled" feature of Ubuntu.
Regards, Siddhesh
you can enable root with the command:
$ sudo passwd {enter the root password twice}
and for GDM access, it can be changed through (gdmsetup) : System > Administration > Login Screen Setup,
Under the Security tab check the "Allow root to login with GDM"
revant
Rony Bill wrote:
My only query is that if root access is not allowed for security, still anyone can simply sudo and gain access. How is the system protected from outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
The "sudo" command prompts you for the user account password, so the hacker will need to know a few details before playing ball.
This distro's flavours (Ubuntu with GNOME, and Kubuntu with KDE) are aimed at home PC users (with an Edubuntu flavour with LTSP support for institutes).
Servers would need more security than Ubuntu (or Kubuntu, or Edubuntu) can provide out-of-the-box, and more likely have something like SELinux installed. However, I'm sure apt-get can bring something to Ubuntu's rescue.
Just wanted to share that I've been a Kubuntu 5.10 (Ubuntu 5.10 with KDE instead of GNOME) laptop user for almost 2 months now, and I have upgraded it with KDE 3.5 just two days ago. And I didn't have to be a genius to do it! Thats the beauty of Ubuntu & it's flavours (and it's burgeoning user communities).
Psst... On a side note, I hear theres going to be a GNUbuntu soon for the loyalists. RMS just struck a deal with Shuttleworth for that. ;)
Sometime on Dec 5, CG cobbled together some glyphs to say:
outside. If anyone can hack into the user account, can he then sudo and play ball? How secure is this sudo?
The "sudo" command prompts you for the user account password, so the hacker will need to know a few details before playing ball.
guys, please don't say hack when you mean crack.
Read http://db.ilug-bom.org.in/lug-authors/philip/docs/hackers-not-crackers.html for more info.
-
(रेवंत) Revan t Nandgaonkar -
Clinton Goveas -
Mrugesh Karnik -
Philip Tellis -
Rony Bill -
Sanket Medhi -
Satya -
Siddhesh Poyarekar