Why is it bad to run as root?

Question

I've often come across posts on forums or other websites where you see people joking in such a manner about running/logging in as root as if it's something awful and everyone ought to know about it. However, there isn't much that a search reveals on the matter. It maybe widely known to Linux experts, but I really don't know why. I remember always running as root when I first tried Linux years ago (Redhat and Mandrake) and don't remember running into any problems because of that. There are actually some distros that have a bright red background with alert signs all over it as wallpaper for the root user (Suse?). I still use the "Administrator" account for regular use on my Windows installation and haven't ever run into any problems either.

Answer 1

It defeats the security model that's been in place for years. Applications are meant to be run with non-administrative security (or as mere mortals) so you have to elevate their privileges to modify the underlying system. For example you wouldn't want that recent crash of Rhythmbox to wipe out your entire /usr directory due to a bug. Or that vulnerability that was just posted in ProFTPD to allow an attacker to gain a ROOT shell.

Its just good practice on any operating system to run your applications on a user level and leave administrative tasks to the root user, and only on a per-need basis.

Answer 2

Just one word: security.

1. You're logged as root = all applications are running with root privilegies -- every vulnerability in Firefox, Flash, OpenOffice etc. now can destroy your system, because possible viruses now have access everywhere. Yes, there are only few viruses for Ubuntu/Linux, but it's also because of good security and default unprivileged user.
2. It's not only about viruses -- small bug in an application could erase some system files or...
3. When your're logged as root, you can do everything -- the system won't ask! Do you want to format this disk? Ok, just one click and it's done, because you're root and you know what you're doing...

Answer 3

This is a good question. I think the answer is slightly different depending on whether you're talking about a server or a desktop installation.

On a desktop, it is uncommon to use the root account. In fact, Ubuntu ships with password access disabled. All changes requiring superused privilleges are done through sudo and its graphical cognates gksudo and kdesudo. Given that it's easy to set a root password, however, why don't people do it?

One reason is that it gives you an additional layer of security. If you run a program as root and a security flaw is exploited, the attacker has access to all data and can directly control the hardware. For example, it might install a trojan or key-logger into your kernel. In practice, though, an attack can do a large amount of damage even without superuser privilleges is large. After all, all user data - including documents and stored passwords - is accessible without root access.

A more valid point, on a single-user system, is that the user is prevented from accidentally rendering the system unusable. If the user unintentionally issues a command that deletes all files, he will still be able to boot the system, even if the data will be lost.

Additionally, most user-facing (X11) applications today are built on the assumption that they're run as a regular user account and without administrator rights. Thus some programs might misbehave when run as root.

On a multi-user system with non-graphical shell access only, many of these reason do not apply. However, Ubuntu still reasonably defaults to an unaccessible root account. For one thing, there is a real difference between gaining access to a user account (with sudo rights) through a security hole and gaining access to root, as in the first case disrupting other users will require running sudo and will still prompt for the account password as an additional security step. For another, it is useful to perform many administrative tasks from a user account and only invoking sudo when the superuser privilleges are aboslutely required. Thus when installing a program from source, it is advisable to build the source - running configure and make - inside the user's directory and only using sudo make install in the final step. Again this makes it more difficult to shoot onself (and other users of the multi-user system) in the foot, and it decreases the likelihood of build scripts wreaking havoc with the system. Thus even on a server it is good advice to stick to Ubuntu's sudo-based administration.

Answer 4

Running as root is bad because:

1. Stupidity: Nothing prevents you from doing something stupid. If you try to change the system in anyway that could be harmful you need to do sudo which pretty much guarantees a pause while you are entering the password for you to realize that you are about to make a possible big/costly change.
2. Security: It has been mentioned already quite a few times in this question but basically it's the same thing, harder to hack if you dont know the admin user's login account. root means you already have one half of the working set of admin credentials.
3. You don't really need it: If you need to run several commands as root and you are annoyed by having to enter your password several times when sudo has expired all you need to do is sudo su or sudo bash or whatever your fav shell is and you are now root. Want to run some commands using pipes? Then use sudo sh -c "comand1 | command2".
4. You can always use it in the recovery console: The recovery console allows you to try and recover from doing something stupid or fixing a problem caused by an app (which you still had to run as sudo :)) Ubuntu doesn't have a password for the root account in this case but you can search online for changing that, this will make it harder for anyone that has physical access to your box to be able to do harm.

The reason why you couldn't find information about why it's bad is because, well, there is way too much data in the internet :) and that a lot of people that have been using Linux for a long time think like you do. This way of thinking about the root account is fairly new (a decade maybe?) and a lot of people still get annoyed by having to use sudo. Especially if they are working on a server which means they went in with the intention to make system changes. Probably brought on from previous bad experiences and security standards most sysadmins know better but they still don't like it :).

Answer 5

One reason not to run as root that has not (so far) been identified by other answers is trackability. It probably matters less on machines that are primarily single-user machines (your desktop or netbook), but on server machines, if someone is logged in as root, you don't know who to blame for the actions taken. Therefore, most professional organizations with multiple systems and multiple administrator that need root privileges require people to login using their own user ID (and password), and then use sudo or similar programs to operate with root privileges when necessary.

Otherwise, the primary reasons for not running as root are:

• Minimize risk of damage from accidents. If you run rm -fr / home/me/my-subdir as root, then you've just dramatically eliminated everything of importance from your machine because of that space after the (first) slash - because the stuff that goes first is the stuff that was added first - little things like the kernel, the /bin and the /etc directory. Unix gets upset if you lose those.

• Minimize risk of damage from malicious outside sites. If you browse as root, you're more nearly vulnerable to drive-by downloads of malicious material.

I use MacOS X more than I do Ubuntu, but there, root is disabled by default, and it still is on my machine. I routinely upgrade the kernel and other similar operations - using sudo (behind the scenes). Similar techniques apply to Linux generally.

Basically, you should only use the all-powerful privileges of root for abbreviated periods of work to avoid the risk of mistakes.

Answer 6

Root account is disabled by default - meaning that it exists but its not usable (except in recovery mode).This means that an attacker is aware of your root account, but couldn't use it even if he/she had the root password. Thus, an attacker has to guess both a user-name which has administrator priveleges, AND that user's password (which is far more difficult than just trying to work out the root password).In XP if you have the Recovery Console installed, anyone who has physical access to your box can boot into it (RC) - no password required. Same as Recovery Mode in Ubuntu.

In Ubuntu, when they say that the root is disabled - what is really meant is that the account is locked.An account is locked by changing the password to a value which matches no possible encrypted value. This effectivly prevents anybody from being able to log into root - since there would be no possible way they could enter the password. Since there are still times when root access is necessary - the Ubuntu kernel has been modified to allow root local login only in single-user mode.

Also see this page

Answer 7

It is like eating diner with a pitch fork when a regular one would do. Only bad things can happen.

:)

Answer 8

Very nice question... Let me answer it from a practical point of view:

When I started using Linux, which is more than 10 years ago, the major distributions did not advertise using non-root accounts as much as today. As I was used to Windows I also did not see a point in using a constrained user account. In particular because I had to enter "su" very often - sudo wasn't that popular back then. ;-) So I always logged in as root because I had a lot of maintenance to do to get my system well configured. But guess what, any fresh installed system became quickly very unstable.

One concrete problem for instance: I haven't had that much harddisk space reserved for Linux so it happened to me a few times that I had 0 bytes left on my partition. Maybe I'm not completely precise because I don't know the exact mechanism, but when you fill up a disk with a non-root account there are always a few kilobytes left. But if you really have 0 bytes left, your system makes weird errors and you might end up with some hard to fix damage in your system because there is a lot of system software running in the background...

Another thing is: That division between root and non-root keeps your system well-organized. As a root-user you might be tempted to not cleanly install your new applications which leaves you with a dirty, hard maintainable system.

But the good thing: Modern distributions do most of the administration tasks for you, so seldom you have to fiddle in the guts of your Linux system with a root account. Entering a password from time to time is sufficient, the rest is done by the distributor's scripts.

But I doubt that you haven't had issues on your Windows system with that if you used 95 oder 98. (At least I had issues with that...) Because of the lack of a clear separation between Administrator and regular user "traditional" Windows apps assume they can do anything E.g. install Spyware if they feel like it, even without telling you. Microsoft engaged in that issue when releasing Vista. (Effectively implementing a sudo mechanism.) So people got very annoying dialogues saying "You can't do that". For some non-Vista-compliant software you needed some dirty hacks to install it, even as Administrator...

Answer 9

There are lot of aspects behind this approach. Some of them are:

Root is all powerful.

In Unix and Unix-like systems, system administration privileges are all or nothing. A user either has root access or not, and root access implies complete control of a machine. If the machine in question is used by more than one person, or root has access to other systems or user files, it is more acceptable to give some users partial root privileges.

The root user can hide all of their actions.

sudo logs every command run via sudo. Having a record of what's being done with sudo helps us diagnose problems with individual systems/processes and general confiugration issues, as well as helping us identify needed improvements.

The root password gives you access to any command on a system.

Via its config file, sudo can give a user root access for particular set of commands. This also avoids the "all or nothing" effect, alllowing us to give individual users more control over their machines and to help themselves out of common problems.

here is a good article : http://cf.stanford.edu/policy/root

Answer 10

Its like arming a little kid with an AK47, while he can happily play with his toy gun ! ;)

I mean its wrong because you and your applications will have more privilege then they need and that is when things can and sometimes will go wrong :(

Answer 11

When logged in as root it makes it possible for applications, scripts or commandline commands to access sensitive parts of software which can damage the system. This can be the result of inexperience on the user or programmer's part or due to malicous hidden code.

Answer 12

It's just too easy mess up when operating as root. You can clobber the entire system in like one command ...

Answer 13

Among other answears I can add that there is a difference between Administrator in Windows and root in Unix. Administrator still have some restrictions in systems, where root does not have any restriction. The correct analog of root in Windows is System user.

The bad thing to use PC under root/System is that you can accidentially destroy anything without any warning from OS.

Answer 14

If applications are run as root, there is no guarantee that none of them would execute

Answer 15

Software is based on shared libraries, dependencies, configuration files, etc.
Most of the times, a single click in an application invokes a "chain reaction" of multiple changes, not only where you think it would probably.
When these changes are about to affect system-critical settings, it's good for you - as a user - to know.
That's why root access is a good security model:
If something crucial is about to happen to your system, you'll be notified by being asked for privilege elevation.

Answer 16

Reasons against using root:

• Could accidentally destroy system files
• Could get an infection
• Doesn't log actions

Reasons FOR using root:

• Access to everything, no typing passwords
• GUI, no using terminals for managing system files/directories

Seems to me that a non-root account could still fall victim of those reasons against using root, the most it adds is a confirmation for your actions. I think that as long as you know what you're doing, you're perfectly safe using root. There, I said it.

Answer 17

rm /*

Lets say you have been cleaning out an administrative area. You get tired of password, so you sudo su. You get distracted just for second and forget you cd to /. Then you rm *. I've done it. You can get it all back, but it's apita. Oh, and it's desceded into /media too!