init 3 in raspbian

[rysic]

Hi!

I installed Raspbian with graphical mode but I'll not use it all the time - main purpose is WWW server. Te save resources I'd like to boot it by default in text mode. I changed /etc/inittab file to:
id:3:initdefault:
but it steal boots in graphical mode. Why?

Anyway, is that normal in Debian that I can sudo any command which I want? Isn't it security hole?

[Joe Schmoe]

Just out of curiosity, why do you think that "level 3" is text mode? (It could well be, but I've always used "level 2" for text mode)

Anyway, I think most people here will tell you to use "raspi-config" to change it - rather than to edit the inittab file.

[rpdom]

Hi!

I installed Raspbian with graphical mode but I'll not use it all the time - main purpose is WWW server. Te save resources I'd like to boot it by default in text mode. I changed /etc/inittab file to:
id:3:initdefault:
but it steal boots in graphical mode. Why?

In Debian/Raspbian the runlevels 2-5 are the same, unlike other distros.

If you want to boot to text mode then run sudo raspi-config and select the default option in there.

Anyway, is that normal in Debian that I can sudo any command which I want? Isn't it security hole?

It is not normal for Debian, but makes things easier for newbs to the Pi. Not sure I agree with that, but I'm not going into that argument here. For security you should at least change the password for the "pi" user from the default.

[rysic]

OK! It looks different in Debian than in SUSE (my main system) - http://en.wikipedia.org/wiki/Runlevel
I thought that it is symilar in every Linux.
I'll check this configuration commands. Thanks!

[Richard-TX]

Anyway, is that normal in Debian that I can sudo any command which I want? Isn't it security hole?

It is not normal for Debian, but makes things easier for newbs to the Pi. Not sure I agree with that, but I'm not going into that argument here. For security you should at least change the password for the "pi" user from the default.

Yes it is a security hole and a very large one at that.

I disagree with the use of sudo. sudo should have never been enabled by default. It teaches bad habits and hides what is really happening. The way I see it, might as well just assign a password to the root account and login as root every time.

The other option is to do a "sudo bash"

POOF! root shell and no more typing sudo at all. TMOUT should also be set despite the fact that TMOUT can be thwarted.

[Richard-TX]

I just tried run level 3 on my Rpi running 9-25-2013 Raspbian. By default it was in run level 2. Doing an init 3 brought up the xdm login screen

[jojopi]

Yes it is a security hole and a very large one at that.

In the simplistic Unix security model, to make changes that affect all users you generally need to be root. So, the fact that you can obtain a root shell is not a security hole, it is a necessity.

When a particular account can obtain a root shell, whether by su or sudo, with or without a password, it is equally trivial for malicious code to escalate privilege. If there is a password, it just arranges for the escalation to take place the next time the user legitimately types it.

sudo does not teach bad habits. It helps to avoid having a shared root password that, if leaked, works for everyone. It allows specific users to be permitted to run specific commands, and logs their use. It becomes increasingly valuable when you have a non-trivial number of users and roles.

You have previously recommended doing everything as root, and treating that as the only account. You cannot seriously pretend sudo is less secure.

[Richard-TX]

sudo vs logging in as root is equal in risk except that the root passwd is never set to a default. Both are a problem but sudo is worse by virtue that the noobie just doesn't understand what they are doing when they type sudo blah. To me that lack of knowledge is inherently more dangerous. That same noobie likely never changes the pi password nor creates a regular account for themselves.

When it comes to sudo as configured, all that is needed is the pi account password and the system is completely open without regard to additional safeguards like additional prompting for passwords. Have a RPI in the office, leave the terminal session open and anyone could walk up and type "sudo cat /dev/urandom > /dev/mmcblk0" Poof! no more OS, filesystem, commands, etc.

I say that the noobie should learn what a regular account is, what the limitations are, etc. They should also know that mistakes at a root prompt are unforgiving. If they do a "rm -r /" as root then the system is going to go away. If they want to do a "rm -r *" as root they should have the foresight to do a "pwd" before they execute that command.

Where I work many different people have root access to the thousands of Unix/Linux boxes that the company owns. How do they manage it? 2 ways.

1 - When sudo is invoked, the user is always prompted for a password.
2 - All commands typed as root are logged to a central security server.

Sure I could log into a variety of servers and wipe them out but if I did that two things would happen.
1 - My career would be over. I doubt anyone would hire me as a Unix/Linux engineer.
2 - I would be facing several Federal Charges. Some of which would be categorized as terrorist activities and others would fall under the heading of industrial sabotage in excess of $10m. In short, I would likely be imprisoned for the rest of my life or placed in a psych hospital for the criminally insane.

There is a vetting process before one gain root access where I work. Understanding the possible consequences is part of that. The other is proficiency. Sudo just becomes part of the command needed to "make things work". I have seen it happen before on Xenix systems. The Rpi is no different in that respect.

All I am saying is that we should be educating the people about good policies and procedures. Not just blindly have they type in some magic incantation they learned by rote every time they want to do something.

Is the Rpi a teaching platform that teaches not only interfacing and integration but also teaches good *nix SA procedures or is it an experimenter's SBC that can just get thrown away if something or anything goes wrong? Right now sudo is so pointless that people might as well type in sudo bash/csh/sh/ksh and then they don't have to use the sudo prefix until the next session.

I think that raspi-config should be changed so that the first time it is run, it asks the user for their name, creates an account, asks for a root passwd and assigns it and that is the end of it. The traditional pi account is only used for initial setup and then is locked. Need to run raspi-config again? su to root.

If someone want sudo, sus, or anything else, they can add it and configure it themselves.

FWIW

Richard

BTW init 2 and init 3 work find under raspian for controlling gui/text login behaviour

[Tarcas]

Right now sudo is so pointless that people might as well type in sudo bash/csh/sh/ksh and then they don't have to use the sudo prefix until the next session.

I think there's a perfectly good point, and you've given it:

They should also know that mistakes at a root prompt are unforgiving. If they do a "rm -r /" as root then the system is going to go away. If they want to do a "rm -r *" as root they should have the foresight to do a "pwd" before they execute that command.

Additionally, making them at least use sudo encourages them to learn what sudo does, what permissions are, and what the difference between root and a user are. If everyone just logged in as root, that's just encouraging bad practices. Even if it's not perfect, it's better than your (hopefully tongue-in-cheek) suggestion.

I think that raspi-config should be changed so that the first time it is run, it asks the user for their name, creates an account, asks for a root passwd and assigns it and that is the end of it. The traditional pi account is only used for initial setup and then is locked. Need to run raspi-config again? su to root.

I agree with this for home users. However, the Pi is designed as an educational tool. In a classroom environment, it is very convenient to be able to give the students one username and password combo that just works. Yes, they could offer a separate "classroom distribution" with the standard pi/raspberry account, or make the teacher set it up themselves, but what they have done is fine. Home users can change the password if they choose (although I do wish it was in more setup guides as a step that should be done.)
I've changed my Pi password, of course I'd been using Linux for over 15 years already. I'd be curious to see a poll (or scan? ) of how many users still have the default account/password combo.

[rysic]

I tried configure init lvl 2 in /etc/inittab:

Code: Select all

# The default runlevel.
id:2:initdefault:

but system is still booting in grapgical mode.

[rpdom]

I tried configure init lvl 2 in /etc/inittab:

Code: Select all

# The default runlevel.
id:2:initdefault:

but system is still booting in grapgical mode.

Did you try, as I suggested earlier

If you want to boot to text mode then run sudo raspi-config and select the default option in there.

[rysic]

It helped. I didn't try it because I thought that I'll be not able to switch fast to graphical mode but init 3 is switching it correctly.
Anyway I would be nice to know why init in lvl 2 is not working and what is doing this tool in background

Thanks!