Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Why does Ubuntu not allow the GUI users to login as root at the time of system start up like administrator in Windows?

Why they are restricting us to login only through the terminal?

share|improve this question
3  
Please also be aware of 'gksu' which allows you to run graphical apps as root. I.e. "gksu nautlius" –  Jeremy Oct 13 '10 at 14:11
1  
Some distros do allow you to login to X as root. CentOS6.2 is one of them. –  djangofan May 9 '12 at 5:10

14 Answers 14

In standard Ubuntu, root logins are not allowed, neither from the GDM (graphical) login manager, nor from the text console (i.e., the one you get if press Ctrl+Alt+F1).

In order to perform root (i.e., administrator) operations you have to use the sudo command in a terminal, or any GUI equivalent of it: these will ask you for your password and then perform the requested privileged operation (and only that one).

The reason for this behavior is, as others have pointed out, that performing root operations is inherently risky and the number of operations really requiring root privileges is comparatively small: by using this sudo approach you are running most of the time with a unprivileged account (i.e., harmless to the system and other users) and just get the root powers when it's really needed.

An example might help clarify. Assume you want to install a new service (daemon) on your machine; this is relatively new and you need to read about it and how to configure it to your needs. You will end up browsing the web a lot to find information, example configs, etc., maybe have some IRC chat to ask for more info -- none of this requires root powers! In the end, you only need privileged access for two operations:

  1. install the new program (i.e., sudo apt-get install ...), and
  2. edit the default configuration

A commonly accepted principle in computer security is always use the least possible privilege level to perform an operation. -- this reduces the risk that something bad happens because of bugs in the software or errors from the operator.

The Ubuntu default setup goes in this direction; if you were using a root login, instead, you would have ended up surfing the internet, doing IRC (and possibly all the other stuff that one does concurrently) from the root account, thus needlessly exposing the system to a threat.

Update: For your compiler example, I would proceed this way:

  1. Login to the node via SSH as your regular user, and from another Ubuntu or GNU/Linux node where you have a graphical X11 display running. Be sure to enabled X11 forwarding over SSH:

    ssh -X myuser@remotemachine.example.org
    
  2. At the shell/SSH prompt, issue the command:

    sudo /path/to/the/compiler/install/program
    

    This will run the compiler installer with root privileges, and access (through SSH forwarding) the graphical display in front of you.

share|improve this answer
    
Ok. Suppose , I am using one linux machine (having 10 users connected through putty) . I want to install one software(eg: one compiler,also need to set environmental variables for the same) as root to be available for all users. But the installer works only with GUI mode and no command line installer and it will run only with root login. How can i manage the installation? I have met this situation while installing arm-linux-gcc in my ubuntu but i have successfully installed the same in my fedora machine(RedHat shrike version) –  Renjith G Oct 13 '10 at 8:56
    
@Renjit G: well, this is a good question on its own, why don't you just ask it? –  Riccardo Murri Oct 13 '10 at 9:59
    
Thanks.Edited the same in the question bar –  Renjith G Oct 13 '10 at 10:38
1  
@Renjit G: I meant to suggest you ask a new question. Asking many specific questions is better than asking one multi-faceted one, because it allows detailed and to-the-point answers. By editing the current question, the replies you have already gotten look like they only answer half of your question... –  Riccardo Murri Oct 13 '10 at 10:53
1  
Given a compiler like that, I think most of us would be curious which compiler it is. For any software distributed through APT sources or standalone .deb files, installation through the command line using "sudo" is sufficient (yes, even for all users). It's also possible to install such files from GUI for all users, without being root. The GUI password prompt you get is the equivalent of "sudo". –  harms Oct 13 '10 at 14:55

There are two questions here. One is, why is root login disabled by default in Ubuntu? That's been addressed by several of the posts here.

The second question is, why are graphical root logins particularly disparaged?

All the disadvantages of nongraphical root logins apply to graphical root logins too. But when you log in graphically, you run far more programs, operating in a far more complex way, than when you log in nongraphically. The entire graphical user interface and all the graphical programs needed to use a GUI effectively, would be running as root. A tiny security vulnerability in any of them would enable someone to take complete control over your system.

Logging in as root at all is not recommended in Ubuntu, but there is no consensus in the security community that it is universally a bad practice. Graphical root logins, however, are simply a bad practice, and almost all operating systems have phased them out or strongly recommend against them.

To a lesser degree, having a non-root user (especially one with the ability to perform operations as root with sudo or PolicyKit) in a graphical login presents risks. But they are far more controlled than when everything in the graphical environment must actually be running as root with unlimited capabilities. Still, for situations where security is paramount, it is usually advisable to do away with graphical interfaces altogether, which is why Ubuntu Server doesn't ship with a GUI by default and officially recommends against installing one (though it is supported to do so).

In the Windows world, you can now install Windows Server in a way that essentially eliminates the graphical user interface (technically, some elements remain, but it is very stripped down and you cannot run arbitrary graphical programs). This is based on the same reasoning.

Even if you do decide to enable root logins, please don't log in graphically as root. Enabling root logins may put you at slightly higher security risk; running an entire graphical environment as root puts you at enormously higher risk.

Additionally, with the exception of graphical administration tools that are designed to be run as root with gksu/gksudo/kdesudo, most graphical programs are not intended to be run as root. Because they are not extensively tested in this mode, they may fail or behave erratically (which would be particularly bad, since they're running as root).

Finally, even some graphical administration tools, like users-admin, will fail if run as root, since they expect to be run by normal users and to perform actions as root (without ever actually running as root) using PolicyKit.

share|improve this answer

Open Terminal (Ctrl+Alt+T or Dash home > More Apps > Installed (Expand) > Terminal).

TO ACTIVATE THE ROOT ACCOUNT

In a terminal type or paste sudo passwd root. Enter your normal login password (if you are asked for it), then you will be asked to enter the new root password and confirm it.

TO ADD A NEW LOGIN PROMPT THAT ALLOWS YOU TO ENTER ROOT AND ITS PASSWORD

In a terminal type or paste. gksudo gedit /etc/lightdm/lightdm.conf. This opens a graphical text editor window where you can edit the configuration file for the login screen.

Add the line greeter-show-manual-login=true to the bottom of the file.

The file should now read as follows:

[SeatDefaults]
greeter-session=unity-greeter
user-session=ubuntu
greeter-show-manual-login=true

Save the lightdm.conf file and exit from gedit.

Reboot Ubuntu 12.04 and you will see a new “Login” window (replaces the previous "Other" window) which allows for Username and Password input . Enter root for the username and then enter the password you assigned to the root account.

I hope this helps others that need/want root access.

share|improve this answer

as for ubuntu 12.04 LTS you can do this using root privilege:

echo "greeter-hide-users=true" >> /etc/lightdm/lightdm.conf

Then you are asked to type both the username and password to login graphically. I'm assume you have already set the password for root:)

I know there are countless reason that you shouldn't login directly as root, however, there does exit some rare cases (for example in a test box running in vmware) when you really appreciated the convience of being root.

share|improve this answer

Root really isn't advised for normal usage but sometimes you have a long list of terminal commands that need root privileges and it's just more convenient to login as root. I use sudo xterm or gksu xterm to open a root terminal I think its a little easier to distinguish which term window has root privileges wheen you have the handy "root@" term prompt

share|improve this answer

You should always log on as yourself and then sudo to perform actions as root. Ubuntu is set up to allow you most all access needed by default. Minor changes will take care of the rest (like adding your used to other groups). It is considered poor practice to log in as root. The industry best practice is the default set up here.

Someone able to log in as root can be a very bad thing from a security perspective.

share|improve this answer

Root is not recommended for day to day daily task. As it provides u superuser previledges it can be misused.thus there is no option for root on login.

share|improve this answer

Because it is not recommended to do so unless you know exactly what you are doing. Root is a superuser, meaning it can do anything and everything - it is only meant for administrative tasks. Day-for-day tasks can bear a security risk that WILL be exploited if EVERYONE (or a large proportion of users) used root. Think Windows - 99% of malware and virus problems are from people using admin accounts for everyday tasks.

Let's look at an example.

What if someone breaks into your system and tells it to erase your disks? If you are running as a normal user, the only files you would (should) be able to remove are those that belong to you, and not anyone else. If, say, you had other people using the computer, their files will not be touched at all, no matter how hard you try. That means you will not be able to change any system files, and therefore your system will remain rock-solid and unaffected/uninfected.

If you run as root, however, you can wipe the hard drive entirely, probably do some damage to the hardware itself, and generally render the system unusable. Correction: anyone who can get to run a single command as root on your computer (some malicious website or an email attachment) can do that.

Take a look at http://everyjoe.com/technology/explain-why-not-log-on-as-root/ , is is a nice article that might explain it better than I did.

EDIT: here's another one http://sickness.tor.hu/?p=264

EDIT2: you can always use sudo command or gksu command to run the command as the superuser, both of those work with graphical and command-line utilities. sudo is usually used for CLI, though, and gksu is the graphical password promt that does the same thing.

To an extent, they let you become root temporarily - much, much better than running as root constantly and risking instability.

share|improve this answer
1  
But why Fedora allow this option at start up ? –  Renjith G Oct 13 '10 at 4:45
3  
Ubuntu is designed to be user-friendly, and I would suspect that by disallowing root, they remove the temptation from normal users (read: Linux newbies) running as root. –  evgeny Oct 13 '10 at 4:48
    
I didn't get you. –  Renjith G Oct 13 '10 at 4:54
1  
My comment was slightly wrong. Let's say this instead: by disallowing graphical root login, it prevents people from running as root UNLESS THEY KNOW WHAT THEY ARE DOING. That is, in my opinion, it should only be allowed for experienced users who know and understand all the risks. –  evgeny Oct 13 '10 at 5:07
    
Now it is fine enough. but why don't fedora cum RH following the reverse path of graphical root login ? –  Renjith G Oct 13 '10 at 5:33

Although you can't login directly as root (for the reasons that others have already explained well), you can run GUI applications as root. For example, System → Administration → Synaptic Package Manager is a graphical application that runs as root.

To run an application as root (either a text application or a GUI application), just use one of this commands:

sudo name-of-the-application
gksu name-of-the-application

They're almost identical. The main difference is that the first asks for your password on the terminal, the second uses a graphical dialog window.

share|improve this answer
1  
The difference between sudo and gksu is more significant than where you enter your password. gksu is preferred for GUI apps and sudo for command line see here and here –  Warren Hill Feb 28 '13 at 14:33

The reasoning behind the use of sudo in Ubuntu can be found here. If you ever need a quick way to "go root" I use sudo -s or sudo -i.

share|improve this answer
9  
And to clarify, I believe that sudo -s creates a root session as the user, while sudo -i creates a root session as the root user. The easy way to tell the difference is to issue the command, then do a "echo $HOME" to see what environment is being used. Or "cd ~" then "pwd" would work too. –  Scaine Oct 14 '10 at 13:48

Aside from the mountains of warnings with using root, you can enable root login by logging in and performing the following from terminal:

sudo passwd

This will first prompt you for your password then will ask you to change UNIX password. The password you enter will be for the root account.

The Ubuntu Wiki has a great article on the depths of root and sudo within Ubuntu - caveats and pitfalls.

share|improve this answer

Given that there are no good reasons to login as root, I would guess the difference between RH (allow root login) and ubuntu (do everything using sudo/gksu) is a matter of preference.

As for the other part of your question you should be able to run your graphical installation by logging in as a regular user, pressing ALT-F2 and entering gksu. In the resulting dialog just enter the command that launches your installer.

share|improve this answer

Additional note : Ubuntu is not allowing the GUI users to login as root because Ubuntu prevent you to accidentally remove or delete important files with GUI apps (like nautilus).

With only CLI user interface, it can be reduce the risk of our mistake. But formerly we can't log in with root even in CLI mode because Ubuntu create a random password for root. Root administrative task can only be done by using the user's password with command sudo or gksu.

It's based on Debian rule.

share|improve this answer
    
what gksu command means? –  Renjith G Oct 13 '10 at 8:55
1  
man gksu : gksu - GTK+ frontend for su and sudo –  squallbayu Oct 13 '10 at 11:13
1  
Sorry.Again , not clear enough to me –  Renjith G Oct 13 '10 at 12:22
    
I mean 'gksu' means GTK+ frontend for su and sudo. –  squallbayu Oct 13 '10 at 12:41
1  
yes, you're right. try 'gksu nautilus' in the terminal. Nautilus with root privileges will appear. –  squallbayu Oct 13 '10 at 13:18

Because the root user and Administrator (in Windows) are the equivalent of a God to a computer. That user can adjust anything from file permissions to even erasing the entire file system. It is quite common for the average home user to run as the Administrator (either under that name or another name set up at first boot). Because any program executed as that user is system wide, it becomes dangerous.

The lack of control over Administrative privileges allows for virus/malware or even self-destructive issues. It is because of this that many distros, including Ubuntu, limited the transition to the high power by an extra step (a somewhat cognitive step that helps to insist that "any changes I make here are changes that are grander in scope").

share|improve this answer
    
heh heh. ... "any changes that I make here are grander in scope". –  e.m.fields Oct 13 '10 at 6:18

protected by Community Jan 28 '13 at 2:34

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.