Hi Guys,<br><br>Frankly i just got tired of having to type "sudo" all the time, or having to su everytime i wanted to do something administrative in bash.<br>so i decided to setup my ubuntu machine to allow me to login as root from the GUI.<br>
<br>Initially everything worked out fine, and i thought i was home and dry. i know what im doing with linux, im fairly confident that i <br>dont need to "sudo" everything on my desktop. So by logging in as root... this would make my life so much easier.<br>
<br>I decided i was going to take a break from my machine for while, and clicked "lock screen". the screen dimmed as usual (as though it was locking).<br>i had then left the machine for a bit, got back, moved the mouse, and guess what? the screen undimmed without asking for a password!!<br>
<br>okay, so maybe it was a one off thing. i tried locking the screen again, and again, unlocked without asking for a password.<br> <br>this is weird, and i did some research to figure out what was going on. i then came across the issue at the main xscreensavers website, <br>
xscreensavers has been renamed to gnome-screensaver and is the primary application used to "lock" any open x sessions.<br><br>the following was quoted on their website as the explanation for this behaviour: <br>
<i><br><u><b>"When I'm logged in as root, xscreensaver won't lock my
screen!</b></u></i>
<p><b><i> Don't log in as root.
</i></b></p><p><b><i> Please note that xscreensaver works fine as a </i><i>screen saver
when you are logged in as root: it will not, however, </i><i>lock
your screen when you are logged in as root. This is for good and
insurmountable security reasons.
</i></b></p><p><b><i> In order for it to be safe for xscreensaver to be launched by
</i><i>xdm, certain precautions had to be taken, among them that
xscreensaver never runs as root. In particular, if it is launched as root
(as </i><i>xdm is likely to do), xscreensaver will disavow its privileges,
and switch itself to a safe user id (such as "</i><i>nobody".)
</i></b></p><p><b><i> An implication of this is that if you log in as root on the console,
xscreensaver will refuse to lock the screen (because it can't tell the
difference between root being logged in on the console, and a normal user
being logged in on the console but xscreensaver having been launched by the
xdm "</i><i>Xsetup" file.)
</i></b></p><p><b><i> The solution to this is simple: you shouldn't be logging in on the
console as root in the first place! (What, are you crazy or something?)
</i></b></p><p><b><i> Proper Unix hygiene dictates that you should log in as yourself, and
</i><i>su to root as necessary. People who spend their day logged in as
root are just begging for disaster."
</i></b></p>Apparently this issue affects all linux distros. However, when i log into kde as root (after editing /etc/kde4/kdm/kdmrc), i am able to lock the screen correctly...no problem.<br><br>So this seems then to be a gnome related issue. after much research, the only known work around is to install a program called xlock, with the following command "apt-get install xlockmore"<br>
you then type "xlock" in a terminal to lock the screen.<br><br>now, some things to be careful of:<br><br>GUI's are a known security issue for any linux machine...whether on the internet or with physical access.<br>
this is why root accounts are "banned" by default from logging into the machine in the first place. <br>
<br>
This screen locking work around i have found is used on my office desktop machine... which has no important data stored on it.<br>further to add to this, i have taken other steps to secure my machine from outside access. The only reason i have brought out this topic is <br>
to rid myself of excess sudo commands... though i do understand that sudo is there for a good reason. <br><br>DO NOT ANY UNDER CIRCUMSTANCES DO THIS ON A SERVER.<br>
<br>After doing alot of research, i now understand why logging in as root into a gui can be an issue... i therefore propose the following: <br>
<br>- never run a GUI on a linux server <br>- never ever think of logging into a GUI on a production server as root (this should be easy enough, as the GUI shouldnt be there in the first place!).<br><br>kalpesh<br><br><br>