• atzanteol@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    3
    ·
    6 months ago

    sudo and friends allow you to gain root access while not enabling the root account. If the root account has no credentials then nobody is guessing your password and logging in as an admin.

    On a multi-user system it allows for multiple admins without sharing a password. It also allows providing admin access for “some” things but not others.

    • lemmyvore@feddit.nl
      link
      fedilink
      English
      arrow-up
      1
      ·
      6 months ago

      If the root account has no credentials then nobody is guessing your password and logging in as an admin.

      They just need to log in as you and trick you into entering your password in a seemingly legit prompt.

      On a multi-user system it allows for multiple admins without sharing a password.

      Multiple distinct ssh keys do the same. As long as everybody ends up doing things as the same user it’s all moot anyway.

      It also allows providing admin access for “some” things but not others.

      Can I provide selective access to just some files? Just some network interfaces? Just some ports? Just some parts of RAM or CPU? Without being able to change those limits?

        • lemmyvore@feddit.nl
          link
          fedilink
          English
          arrow-up
          2
          ·
          6 months ago

          The point I’m trying to make is that having just one “super” account for everything is a very poor idea. A lot of work has gone into filtering access to the root account and very little into getting rid of the root account. Ideally nothing should run as root, it should run as individual accounts with varying levels of access on a need-to-have basis.

          • atzanteol@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            3
            ·
            6 months ago

            "That’s* what you meant when you said this???

            I’ve always wondered why we even bother with SUID commands. Why not just log in as root?