rootsusudousers
If you use sudo su - or sudo -s you will get the full root certification "likewise a root user ".
Is this user an official user or is it from canonical?
~$ sudo su -
[sudo] password for username:
root@lp:~# id
uid=0(root) gid=0(root) groups=0(root)
root@lp:~# pwd
/root
root@lp:~#
You are an administrator, but not root. The root user can do anything. Administrators can perform actions as root, but ordinarily what administrators do is not done by root. That way, you have full control over your own system, but only when you choose to use it.
Ubuntu asks for your password when you try to do stuff as root, to make sure it's really you.
Real human users have user accounts to represent them. You created one such account when you installed Ubuntu. But not all user accounts represent real human users.
Real human users are granted (and denied) abilities through their user accounts. They must use their user accounts to use the system; therefore, their user accounts' abilities and limitations apply to them.
User accounts are also used to codify sets of abilities and limitations. Some user accounts--most, actually, unless you have many human users of the machine--exist so that certain programs or commands can be run with their identity, an identity with the right abilities and limitations for the job.
For example, the www-data user exists so that if you run a web server, it owns the data the server make accessible. No real human user has to be empowered to make unchecked changes to those data, and the web server doesn't have to be empowered to perform any action unnecessary for serving the web. Consequently, both the web data and the rest of the system are more secure against accidental or intentional breakage, than if the web server were run by some human user who would have all the powers of the web server (and whose powers the web server would possess).
The superuser, whose username is root, is a non-human user account with a very specific combination of abilities and limitations: all abilities, and no limitations.
root's allowed to do anything. There are still things root cannot do because the system itself cannot perform or make sense out of them. So root cannot kill a process that is in uninterruptible sleep, or make a rock too heavy to move, then move it.
Many important system processes, like init, run as root, and root is used for performing administrative tasks.
root?It's possible to configure the root account so it's possible to log in with a password, but this is not enabled by default in Ubuntu. Instead, you can think of root as being like www-data, lp, nobody, and other non-human accounts. (Run cat /etc/passwd or getent passwd to see them all.)
Human users log in with their own user accounts, and then if some task is to be performed with another user account, they cause that task to be performed with that identity, without actually having logged in as that user.
It's possible to configure the other non-human users, like www-data, so one can log in as them, too. That's quite rare, though, whereas in some other Unix-like OSes it's common to log in as root in a terminal. The risks of running a whole graphical interface as root, combined with how many graphical programs are not designed to run as root and may not work properly, mean that you should never attempt to get a root-owned desktop session.
Please note that while logging in as root is disabled by default in Ubuntu, there are ways to get a root shell without authenticating as root, which produce a similar effect: the most common are sudo -s or -i, recovery mode and similar techniques. (Don't worry if you don't know what those things are.) This is not actually logging in: in recovery mode, you become root before any login would occur; with the sudo-based methods, you're just running a shell as root.
In Ubuntu, administrators are the users who can do whatever they want as root, when they choose to do so.
System Settings > User Accounts. "Eliah Kagan" is an administrator, so he can do stuff as root, but he is not root.
I'm an administrator on my Ubuntu system. When I run programs, ordinarily they run as ek ("Eliah Kagan" is the full name that corresponds to the ek username.)
When I run AbiWord or LibreOffice, it runs as ek. When I run Firefox, Chromium, Empathy, or Pidgin, it runs as ek. The programs that run to provide the desktop interface run as ek.
However, I am an administrator, so if I need to perform an administrative task, I can do so.
On the command line, I would ordinarily use sudo to run a command as root:
sudo command...This will prompt me for my password. (Not root's password; root does not have one.)
root. In the default configuration, I must enter my password to do this.root, even by putting in their password. sudo commands will fail if the user running them is not an administrator.Because administrators are perfectly ordinary users except for the ability to perform actions as root, running a command requiring root privileges will still fail, except when the command is run as root.
Screenshot illustrating the need to use sudo to perform administrative tasks. (Based on "Sandwich" by Randall Munroe.)
Graphical programs can run as root through graphical frontends for sudo, such as gksu/gksudo and kdesudo. For example, to run GParted as root I could run gksudo gparted. Then I would be prompted graphically for my password.
Since I'm prompted graphically, there doesn't have to be a terminal. This is one of the ways administrative tools are run as root.
Polkit (once known as PolicyKit) is another way for administrators to do things as root. A program accesses a service that performs the action. Sometimes, the action is running a whole program; sometimes the action is more limited.
These days, many graphical system administration utilities are set up to use polkit by default, rather than to use sudo.
One example of such a utility is the Software Center. It takes full advantage of polkit, requiring the user to put in their password only when they want to do something that requires root privileges. (This is possible with sudo-based authentication also, but it is harder and uglier to accomplish.)
In the Software Center, I can find and read about an application; then I'm asked for my password when I want to install it.
Any graphical program can be run as root with gksudo and other graphical sudo frontends. (The program might not work very well, depending on whether or not it's designed to be used as root. But the command to start the program will be executed as root.)
While polkit is now more common than sudo GUI frontends as the way applications on Ubuntu perform actions as root behind the scenes, polki will only run a graphical application as root if there is a configuration file allowing it and indicating what actions may be performed.
pkexec is the command used to run a program with polkit.
Like sudo, pkexec can run non-graphical commands. (And it does not require a configuration file defining the command's capabilities--it simply runs the command as root.)
pkexec command...pkexec prompts for a password graphically, even if it is run from a Terminal (this is one of the ways its behavior is more similar to gksudo than to running straight sudo).
(If there is no GUI--for example, if you're logged in from a virtual console or text-only SSH session, or the GUI is not functioning properly--then pkexec will degrade gracefully and prompt for your password on the command line.)
Once authentication is performed successfully, the command runs in the terminal.
rootroot is special because it gets to do anything that can be done. But it's a user account like any account, and the ways of running commands as root with sudo (directly or with a graphical frontend) or polkit can be modified slightly to run a command as any other user:
sudo -u username command...gksudo -u username command...pkexec --user username command...sudo first? How is that security?!Running commands with sudo is sort of like invoking papal infalliblity.
When you run a command with sudo [invoke papal infallibility], Ubuntu [Catholic folks] tries hard to make sure you're really you [really the Pope].
Yes, I know papal infallibility (even when normative) is declarative; the parallel is not perfect.
Trying to do something as root with sudo (or polkit) is a big deal--Ubuntu is not just going to let that slide by like all the other times you run a program.
You are prompted for your password. (Then, that you have done so is remembered for a short time, so you don't have to constantly enter your password as you administer your system.)
Besides reminding you to be careful, this safeguards against two scenarios:
root (which includes anything installed by the package manager, such as LibreOffice), or alter the system at a deep level.su. What's that? Can I use that?su authenticates as another user, and runs a command (or starts an interactive shell). It's possible to limit who is permitted to use su, but su authenticates with the target account's password, not the password of the user running.
For example, su username -c 'command...' runs command... as username, just like sudo -u username command....
But when you run a command as username with sudo, you enter your password. When you run a command as username with su, you enter username's password.
Since su performs authentication for the target user, with su you can only run commands as users whose accounts are enabled.
The root account (like www-data and nobody) is disabled by default. There is no password that will work to log in as root. So you cannot use su to run commands as root.
You can use su to run commands as another user who can log in (which typically includes all the user accounts on your system that represent human beings).
When logged in as a guest, you cannot use su at all.
su and sudoSomeone who is not an administrator can even use su to run sudo as an administrator. (This is OK though, as they need the administrator's password to run commands as the administrator.) That is, a limited user can use su to run sudo to run a command as root. This can look like:
su username -c 'sudo command...'(Running graphical programs this way requires special care.)
su be a more secure way to run commands as root?Probably not.
root?Make them a limited user instead of an administrator.
sudo to root?Unless you have reconfigured sudo to let it succeed without a password, it will fail.
root piggyback on a recent sudo command, so no password is required?This would be very unlikely to succeed. These days, most operating systems (including Ubuntu) have sudo configured by default so that its timestamps apply only in a specific context.
For example, if I run sudo ... in one Terminal tab and authenticate successfully, sudo in another tab (or run by an unrelated GUI program, or that I run from a virtual console or SSH session) will still prompt for a password. Even if it's run immediately afterwards.
No.
sudo or polkit?Potentially, yes. But then it could "listen in" to a password typed in for su.
Don't tell people your password.
Ideally, they should have a separate user account that lets them do what they need to do. For example, can share files between accounts, allowing multiple user to write to them, while still denying access to other users.
However, in a situation where a less-trusted person may be permitted to share your account, it should be a limited user account. You could make a separate account for this purpose (which makes sense--if it's an account for you and someone else who you want to have different capabilities, it should be a different account).
sudo and su and make people log in as root, manually?No, because there are serious disadvantages associated with letting people log in as root at all. Whenever possible, the smallest number of actions as possible should be undertaken as root. Even most acts relating directly to administering a system (e.g., looking at what users are configured, and reading logs) usually don't require root privileges.
Also, just as potentially a malicious program could watch what someone types when they run sudo or su, or create a fake sudo/su password prompt, potentially a malicious program could create a fake login screen, too.
In Ubuntu 12.04 and later, administrators are members of the group called sudo.
In Ubuntu 11.10 and earlier, administrators are members of the group called admin.
When an Ubuntu system before 12.04 is upgraded to 12.04 or later, the admin group is kept for backward compatibility (and continues to confer administrative power to users in it), but the sudo group is used as well.
If you like, sure. Create a limited user account in System Settings > User Accounts, and log in as that user.
Yes, just remove it from the sudo and admin groups (see above).
But you should make sure there is at least one other administrator account, so you can administer your system. If there is not, then you'd have to boot to recovery mode or a live CD and make some user an administrator again. (This is similar to resetting a lost administrator password.)
Graphical tools for administering users and groups will usually keep you from creating a system with no administrators, or at least warn you. Command line tools typically will not (trusting that you know what you're doing).
Change the permission of these folders like this and now you can su to another user.
chmod 755 /
chmod 755 /bin
chmod 755 /lib
Best Answer
Yes the root user is an official one.
That user comes from a long line of historical influences. It's the conventional name of the user who has all rights or permissions. Most Unix-linke operating systems have a root user. It's not always called "root". You may know the Administrator of Windows operating systems.
Some Linux derivates like Ubuntu allow administrator accounts which provide greater access (not a root account). In some cases, specially Ubuntu, the root user is disabled defaultly, because you can destroy the system with the root user if you do not know what you do.
The root user can do things that a normal user cannot for example:
In Ubuntu (and other Linux derivates) there is a mechanism to gain root priviledges for a short amount of time. One of those mechanisms is
sudo.sudocan be used to run a program with root priviledges, but with the users environment.Edit: Short digression about
sudo:The clue is the so called suid-bit that is on some programs such as
sudo. It allows to run the program with root priviledges, even if the root account is disabled (as in ubuntu).sudoitself controls whether the user has the right to execute whatever he wants. So, you executesudoas root andsudodecides if it executes the given command as root.The system would not be operable without the root user. There must be a user with the id 0 and the name root (but it can be disabled due to suid/sudo). Or such mechanisms as the suid bit will not work. Hence your will not be able to gain root priviledges. Source: Wikipedia