• lemmyvore@feddit.nl
    link
    fedilink
    English
    arrow-up
    1
    ·
    6 months ago

    If the root account has no credentials then nobody is guessing your password and logging in as an admin.

    They just need to log in as you and trick you into entering your password in a seemingly legit prompt.

    On a multi-user system it allows for multiple admins without sharing a password.

    Multiple distinct ssh keys do the same. As long as everybody ends up doing things as the same user it’s all moot anyway.

    It also allows providing admin access for “some” things but not others.

    Can I provide selective access to just some files? Just some network interfaces? Just some ports? Just some parts of RAM or CPU? Without being able to change those limits?

      • lemmyvore@feddit.nl
        link
        fedilink
        English
        arrow-up
        2
        ·
        6 months ago

        The point I’m trying to make is that having just one “super” account for everything is a very poor idea. A lot of work has gone into filtering access to the root account and very little into getting rid of the root account. Ideally nothing should run as root, it should run as individual accounts with varying levels of access on a need-to-have basis.

        • atzanteol@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          3
          ·
          6 months ago

          "That’s* what you meant when you said this???

          I’ve always wondered why we even bother with SUID commands. Why not just log in as root?