RE: [tlug] Root - NO KDE

["Jonathan Byrne" <jq@example.com>]

On 6/24/2002, "James Cluff" <jc@example.com> wrote:

>think disabling root loggin is a good practice.

Disabling remote root login can have value, but less than what you may
think; anyone who has compromised your root password has probably
compromised other ones as well, unless they just got very lucky by looking
over someone's shoulder. All they have to do is login as a regular user and
su.  That doesn't mean disabling remote root login has no added value
whatsoever, but it's less than what it might appear at first.  At the
least, it may let you see from which account the su took place if the
intruder is careless and doesn't erase footprints from the syslog.  After
that, you can expect a trojaned syslogd, sshd, etc., so finding out you've
been rooted becomes more challenging.

Disabling local root login is nearly worthless, though.
Anyone who has physical access to your machine is pretty much guaranteed to
be able to root you.  Now, you can make this a lot harder by
password-protecting LILO or GRUB, password-protecting your BIOS and having
it set to boot the disk ahead of the floppy or CD-ROM, etc. (or if you're
really paranoid, remove both of those devices and lock them up somewhere),
but again, someone with
physical access and some time can circumvent those measures.  And anyway,
let's face it, hardly anyone does any of that in the first place.  I've
never worked in such a hostile environment that they were necessary, and
anyway, I know perfectly well that any of my immediate co-workers could
circumvent all those measures in short order in my absence, so there's no
real point.


Jonathan