Security risk in everyday use of an admin account (not root)?

Question

The only thing that distinguishes my admin account from normal accounts is that my admin account is a member of the sudo group and can run sudo. Is it any less secure to use my admin account for daily work? If yes, why?

Assume that I am very careful where I enter my password and know what a command does before executing it, of course.

If I used a normal non-admin account for my daily account, when I needed to run something as root I would su into my admin account (not into root, as that has no password and is disabled!) and there run the sudo command in the admin shell; or, I would switch users graphically. Thus, the amount of commands that would be run is the same -- using a normal account would just mean that I have to enter my admin password twice when running something as root.

So, should advanced users do everyday work on a normal account instead of an admin account? And why or why not?

Please note that by "admin account" I mean an account with privilege to use sudo to run commands as root - not the root account itself. I never log in as root.

Answer 1

An account that can sudo is technically as able as the root account (assuming a default sudoers configuration behaviour) but there is still quite a big difference between root and an account that can sudo:

• Accidentally omitting a single character won't destroy Ubuntu. Probably. Consider trying to delete ~/bin but actually running rm against /bin. If you aren't root, there's less risk.

• sudo requires a password, giving you those milliseconds to work out any mistakes. It also means that other applications don't have the ability to do rooty things on your behalf.

This is why we recommend people not use the root account for everyday work.

---

Insulating yourself with another intermediary "admin" account (and running as a user without sudo access) is just another layer. It should also probably be a different password.

It's extra fuss though and (per your question conditions) if something can sniff out your first password, they can probably get the second just as easily. If you never ever made mistakes, and never use these strong passwords anywhere else (not guessable or crackable), this solution is probably no more secure. If somebody wants root they'll boot into recovery, chroot, or use a wrench.

---

There is also a school of thought that points out that [for non-enterprise desktop users] nothing you value is protected from your user. All your documents, photos, web browsing history, etc is owned and accessible by you or something running as you. Just as you can run something that logs all your keystrokes, views your webcam, listens on your microphone, etc.

Simply put, malware doesn't need root to ruin somebody's life, or to spy on you.

Answer 2

No risk while not root

From my understanding for an administrator, or sudo user it is working just like a normal desktop user as long as we don't say sudo - so there should be no additional risk.

Risk of accidentally becoming root

It is also true that a user having potentially admininistrator permissions needs to watch out at bit closer where, when, or whom they give away their password.

I can imagine (though I never met one) an evil application or a script asking you for your password without telling you what for. It likely will perform something with root permissions, as it would not need your password otherwise. If I don't know what this application does I would simply not give it my root password.

We are also responsible to dismiss root permission again after we are finished. It always is a bad idea to stay root while working with a graphical application such as e.g. Nautilus.

Risk of losing root access

Another "risk" may be that you do something bad with your account that prevents you from logging in. Therefore I always create at least two administrator users on any box I install Ubuntu to. This is for the case something breaks my main account.

Answer 3

Yes, there are risks. Whether or not those risks are big enough for you to care about is a matter of preference and/or your security policy.

Any time you use a computer, you are always at risk from attackers. Even if you run an extremely secure setup, you cannot protect against as-yet unknown vulnerabilities.

If you are using an account without sudo privileges and that account is compromised due to that use (e.g. a keylogger grabs your password), then that adds a limitation on the damage that can be done. If an attacker compromises an account with sudo privileges then they gain those privileges too.

On most systems, using sudo will cause your password to be remembered for 15 minutes by default, which is another risk factor, unless you change that setting.

Answer 4

My opinion-based answer, because everything would have to be proven mathematically, and from that I have no idea. ;)

Two accounts one with groups adm and sudo, means one account have the right to execute commands with sudo rights. One without this privileges.

• If you have cracked the password for the non-privileged account, then you still have to crack the password for the privileged account now. -> Advantage in comparison with only one account
• If you have cracked the privileged account. -> No advantage in comparison with only one account

The probability is 50% if you do not respect the intelligence of the attacker.

From my perspective, it's theoretical a very little security benefit and belongs more to the realm of probability theory. But the loss of convenience increases disproportionately. It depends on how smart the attacker is. Do not underestimate this intelligence. That's a false sense of security.

In other words, no, it brings you no measurable benefit, but you lose a lot of convenience. At the end everyone must decide for themselves.

Answer 5

I run exactly like that: One user where I do my user stuff and one user where I do only admin stuff an no user stuff. Even the command prompts are different: users have a green prompt and admins a red one!

Why?

The user had its own settings for all of the applications that I use separate from the admin user, which allows you to:

1. Debug whether an issue is user-related or system related
2. Have the admin account as a backup user account instead of the guest account and root account if anything goes really wrong with your user settings and you cannot log on any more.
3. keep admin docs and user docs separated in their respective home directories if you choose to do so.
4. No effect when typing an accidental sudo before a command.
5. No way to actually see what a normal user is not supposed to see.
6. No way of hitting a user privilege escalation bug. (there have been a few in the past)
7. Be a "normal user" just like all the other users on your computer and know what the advantages/disadvantages are.