6

From http://ubuntuforums.org/showthread.php?t=716201:

Policy

Tutorials explaining how to enable the root account for a graphical login or autologin will not be supported on the forums and will be moved to the Jail. Although we believe people should have the freedom to run their computers however they want, we also believe in supporting Ubuntu's security model. You can find or post information elsewhere on the internet regarding graphical Ubuntu root logins; such tutorials do not have to be hosted on the Ubuntu Forums.

Users posting such tutorials after this announcement will be given a warning or infraction at the discretion of the staff.

Should we adopt that and close questions like How to enable root login?

2 Answers 2

17

I disagree.

On the stance that if people want to know how to do this then it's better getting the whole answer from an authoritative source like Ask Ubuntu rather than some back-ally forum or blog.

Knowledge is power

To be honest, activating the root account - typically via password change - isn't any more dangerous then a flimsy password for a user in the admin wheel group. What can be done by root that can't be done already via sudo/gksudo with this - mind you default - level of access?

%admin ALL=(ALL) ALL

On the note that it's easy for a user to forget they're in root and run a command that breaks something. It's just as equally easy for a user to run a command via sudo and mess something up.

Unfortunate as it may be, mistakes happen every day without root 'activated' - As long as cautions are thrown into the answers like Ads were on Geocities (Like we currently do on activities that are potentially harmful) there shouldn't be anything wrong with accepting questions pertaining to root, how to activate root, and how to use a graphical root should be allowed.

1
  • 4
    Aye. We should be creating responsible users, not encouraging the idea that sudo is a magical safeguard. Sudo is a wonderful tool, but not a panacea.
    – djeikyb
    May 23, 2011 at 21:00
9

I don't like to rule technical things off-limits but I can't help agreeing with the sentiment. There certainly only ever needs to be one question about this but that question currently has the line:

i realise the security implications of this .

While this might be suitable protection for Alaukik, anybody else that reads the question isn't getting a suitable warning.

As with anything dangerous, there should be something big and bold added to the end of the question explaining why this is a bad idea for most people.

Edit: In this case I've appended the following onto the message, linking to existing questions that already:

#Warning: [Running as root is a bad idea](http://askubuntu.com/questions/16178/why-is-it-bad-to-run-as-root) - You never need to do it but if you do you can very easily and irreparably destroy your system and your data.

It's pretty bold but I don't think you can be too bold when it comes to these things. If you see something similar, I'd encourage and sanction a similar edit.

And I know the issue hasn't arisen yet but if somebody removes the warning, flag it up. Users' security should come before the presentation of somebody's post.

4
  • 2
    I think it should be the answers responsibility to include that information May 22, 2011 at 14:15
  • i have edited the answer to include this .
    – Lincity
    May 22, 2011 at 14:22
  • 2
    I think it depends on the question. In this case any answer is going to be equally dangerous because the question is asking to do something inherently dangerous. @Alaukik, I've moved the comment back to the question.
    – Oli Mod
    May 22, 2011 at 16:30
  • 1
    The linked question, "Why is it bad to run as root," is misleading. In Ubuntu's default configuration, running a command with sudo is running a command as root, and it is trivially easy to open a root shell. The security risk that is being avoided is direct login by root. With root logins enabled, an attacker already knows the most important username on the system, and if successful in logging in, can easily bypass logging and take control of a system without the legitimate users even knowing.
    – bgvaughan
    Jun 6, 2011 at 23:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .