I am fairly new to server administration, and I have seen a lot of sites recommending to assign sudo privileges to a user created by the root user and giving the root user an insanely long password for security enhancement.
If the newly created user can perform the same functions as a root user however, what is the actual benefit of doing this at all?
There are several benefits to using
sudo
over handing out the root password. In no particular order:You aren't giving out your root password
As a general rule, if someone leaves your company and they knew the root password(s) you now have to go change those passwords everywhere. With proper configuration management this is a minor annoyance. Without it it's a huge chore.
You aren't giving away the keys to the kingdom
sudo
allows you to specify a restricted list of commands that users can run, so if you decide that Alice only needs the ability to stop and start Apache, but Bob needs full root rights you can set them up accordingly.You can manage authorization centrally
sudo
supports LDAP configuration, which means every system in your company can look at a central LDAP server to determine who is allowed to do what.Need to authorize (or de-authorize) someone? Change the sudoers configuration in LDAP and all your systems are updated at once.
There's an audit trail
With the exception of users that are allowed to do
sudo su -
,sudo sh
, or something equivalent,sudo
will produce an audit trail of which user ran what commands.(It will also produce a list of the people who gave themselves an unlogged root shell, so you can point your finger at them and hiss in disapproval.)
sudo
is good for more than just root Everyone concentrates onsudo
as a way to do stuff as the superuser, but that's not all it's good for.Say Alice is responsible for a particular software build, but Bob should be able to run the build script too. You can give Bob an entry in sudoers that lets him run the build script as Alice's user. (Yes, sure, there are much better ways to deal with this particular case, but the principle of
Let user A run a program as user B
can be useful...).You also get all the same audit-trail benefits that I mentioned above when you do this...
The primary difference is that users authenticate to
sudo
using their own password, whereas withsu
or direct root login the root password is used.This means that you don't have to share the root password with all and sundry, and that if you need to disable root access for one or two users in the future, you can just disable it for them, instead of having to change the root password.
sudo
is also capable of limiting which commands each user can run as root, so specific users can be given access only to the tasks they need to perform, if they do not require full root access.On top of the answers given, which are valid, don't forget that a user logged as root can potentially break the system at every command. If you force them to type sudo before doing something potentially dangerous, at least you make them aware that they need to double check before doing a particular command.
Yes indeed - from a control and logging perspective sudo is much better.
For example - if you su the only event captured in the logs is you su'ing. Anything after that goes as root. And if you've ever looked at logs in Unix/Linux you know root does a butt load of stuff.
Sudo on the other hand logs pretty much everything AS the originating user.
Using sudo makes it harder for a malicious user to gain access to a system. When there is an unlocked root account, a malicious user knows the username of the account she wants to crack before she starts. When the root account is locked, the user has to determine the username and the password to break into a system.