Subject: connecting as root

From: Martin Wilhelm Leidig <[email-masked]>
Date: Fri, 28 Jan 2000 01:04:09 +0100

Hi, folks!

I'm using netatalk-1.4b2+asun2.1.3 on LinuxPPC Q3 (based on Red
Hat 6.something) and want to connect as root from MacOS D-8.1.
"Normal" user log in is fine, but root login seems impossible.

On
<http://www.umich.edu/~rsug/netatalk/archive/admins/1998/1861.html> I
found that:

>From: [email-masked]
>Date: Thu Oct 08 1998 - 01:22:37 EDT
[...]
>to connect as root, comment out the "if uid == 0" part in
>afpd/auth.c
[...]
>On Thu, 8 Oct 1998, jesse reynolds wrote:
[...]
>> Now i'm wondering why it is I can't connect as root...

Is there no other way?  I'd like to use some configuration file
or other trick rather than hacking source files and compiling.

Thanks for all!

-Moss-

---

From: Alistair Riddell <[email-masked]>
Date: Sat, 29 Jan 2000 14:19:04 +0000 (GMT)

There are sound technical reasons(tm) for not connecting as root. That is
why it is not a config file option. 

You can't normally connect as root to ftp or any other remote service, it
is not just netatalk that enforces this.

-- 
Alistair Riddell - BOFH
IT Support Department, George Watson's College, Edinburgh
Tel: +44 131 447 7931 Ext 176       Fax: +44 131 452 8594
Microsoft - because god hates us

---

From: Patrik Schindler <[email-masked]>
Date: Sat, 29 Jan 2000 18:33:28 +0100

>why it is not a config file option. 

In Detail: UID 0 is superuser under unix, for MacOS this is Guest.
You may connect as root but you don't have the permissions you expect.

:wq! PoC

---

From: Martin Wilhelm Leidig <[email-masked]>
Date: Sat, 29 Jan 2000 19:14:25 +0100

Alistair,

>why it is not a config file option.

Could you (or another one) please explain those technical
reasons a bit further (and why it shouldn't be a config file
option therefor)?  I know that netatalk would spread it's
.AppleDouble files all over the file system if I'd mount /, but
that shouldn't be a problem as the disk is big enough.  What
other reasons are there?

Another question: is there information on that on the Web?  I
have the HOWTO and looked into FAQ-o-matic but didn't find more
dokumentation.

>You can't normally connect as root to ftp

Sorry, I can.  Wednesday I forced proftp to let me in as root,
and i did that with MkLinux' ftpd before.

>or any other remote service, it is not just netatalk that
>enforces this.

With telnet I can, too.  Otherwise I couldn't administrate my
Linux-Mac from the MacOS-Mac, and that's the cause for my desire
to <Subject>.

[snip]

>Microsoft - because god hates us

Yeah, man ...  :-))

-Moss-

---

From: Darron Froese <[email-masked]>
Date: Sat, 29 Jan 2000 11:56:43 -0700

on 1/29/00 11:14 AM, Martin Wilhelm Leidig at [email-masked] wrote:

> option therefor)?

Martin,

Generally, connecting as root is somewhat discouraged because of a few
reasons:

1. Since you are the "god" user on the system - a simple mistake when you're
deleting or overwriting things can be disastrous. You could destroy
everything and not get much warning - because you're root.

2. Connecting as the root user over such methods as telnet, ftp - or
anything else - exposes your root password in cleartext over the network.
That's another bad idea - if you don't understand why, then that's another
reason why you shouldn't be connecting as root.

The best way to connect to your box and administrate it is probably this:

1. Probably change your root password - as it's gone over the wire a few
times already. ;-)
2. Undo your changes to allow root to login via ftp and telnet.
3. Learn to use "su" to *change* to the root user when you're already logged
in with a normal username and password.
4. Download and install OpenSSH <http://www.openssh.org/> on your Linux box
- this is sort of like "encrypted telnet" - in other words, your password
(or any command for that matter) never goes over the wire in cleartext.
5. There is a ssh client for the MacOS for OpenSSH and you can get it here:
<http://www.lysator.liu.se/~jonasw/download/niftytelnet-1.1-ssh-r3.hqx>

Hope that helped at all. If you have any more questions - please let me
know.
-- 
Darron
[email-masked]

---

From: Alistair Riddell <[email-masked]>
Date: Sun, 30 Jan 2000 00:11:11 +0000 (GMT)

In addition to these reasons there is also accountability. The idea is
that in an environment where more than one person might know the root
password, unless you have physical access to the console you must
authenticate yourself as a normal user to make your true identity known
before you change to root.

---

From: Martin Wilhelm Leidig <[email-masked]>
Date: Sun, 30 Jan 2000 19:11:32 +0100

Alistair Riddell wrote in "Re: connecting as root" [00-01-30
>before you change to root.

Yeah, also a good idea _if_ there is more than one user - but
_I_ do know myself ...  ;-)

-Moss-

---

From: Martin Wilhelm Leidig <[email-masked]>
Date: Sun, 30 Jan 2000 19:09:47 +0100

Darron Froese wrote in "Re: connecting as root" [00-01-29 19.56
>everything and not get much warning - because you're root.

Right - but where's the difference between breaking the linux
box via normal console login and netatalk login?  I don't want
to login _every_ time as root, I just want to have the _chance_
to do so!

>anything else - exposes your root password in cleartext over

Right again, but the only guy to whom I could expose anything on
my network is myself - or in other words: there are exactly
exactly two machines, one ISDN Router, and one user (me - with a
bunch of login names ;-).

Yes, I know that there's a chance to pick my (dynamic) IP when
I'm connected to the Internet, but then - to whom should my
otherwise isolated system be of interest?  I do not chat nor ICQ
nor extensive surf sessions - I'm getting eMail three or four
times a day, and that's all for most days.  So I estimate the
risk pretty vanishing.

<snip>

Thanks for your advice; I think I answered already.  ;-)

><http://www.lysator.liu.se/~jonasw/download/niftytelnet-1.1-ssh-r3.hq

I have and use that!  ;-)

-Moss-

---

From: Martin Wilhelm Leidig <[email-masked]>
Date: Mon, 31 Jan 2000 08:20:03 +0100

Patrik Schindler wrote in "Re: connecting as root" [00-01-29
>You may connect as root but you don't have the permissions you

Thanks, that's something I understand.  No workaround?

-Moss-