On 12/11/06, Art Alexion <<a href="mailto:art.alexion@verizon.net">art.alexion@verizon.net</a>> wrote:<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Sorry, Tez, I don't mean to be difficult. I LIKE sudo most of the time, but... On Thursday 07 December 2006 16:48, Tez wrote: > Art Alexion wrote: > > On Thursday 07 December 2006 09:03, Raphaël Pinson wrote: > >> `sudo -i` and `sudo -s` provide you a root console that lets you use > >> this program just the same as if you were logged as user root. > > > > So if you get a root console, with all of its insecurities, why is doing > > it that way better than just su? > > Because, > 1) only members of the adm group can get a root shell and And how is this different/better than only giving admins the root password?</blockquote> <div> Because anytime you can remove people from this group and thus take away their rights without changing the admin password. If you have a root account, you have to change the password if you want someone to stop administrating the machine, and let all the other admins know about the change. </div> <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">> 2) you don't have to give out a root password for more than 1 user to > run privileged commands. And letting people use their own password to perform root activities is more secure than restricting who gets a password because ... ?</blockquote><div> For the same reason than the one I just told a few lines up. Just as using ssh-keys is more secure than using password logins, because you can just remove the key of a user and he stops getting an access... Easy and secure. </div></div> Regards -- ---------------------------------------------------------------------------------------- Raphaël Pinson - <a href="mailto:raphink@ichthux.com">raphink@ichthux.com </a> <a href="http://www.raphink.info">http://www.raphink.info</a> Ichthux - <a href="http://www.ichthux.com">http://www.ichthux.com</a> - Linux for Christians