1 00:00:00,000 --> 00:00:01,170 In this video, 2 00:00:01,170 --> 00:00:02,610 you're going to learn about the privileges 3 00:00:02,610 --> 00:00:05,130 that a superuser has in order to create accounts 4 00:00:05,130 --> 00:00:06,180 for other users, 5 00:00:06,180 --> 00:00:08,580 as well as perform many other administrative tasks 6 00:00:08,580 --> 00:00:11,100 that we're going to discuss later throughout this course. 7 00:00:11,100 --> 00:00:13,200 Now anyone who's using a Linux computer 8 00:00:13,200 --> 00:00:15,840 should always have their own unique user account. 9 00:00:15,840 --> 00:00:18,750 These user accounts are usually set up by an administrator, 10 00:00:18,750 --> 00:00:21,510 and these accounts control a user's access to files, 11 00:00:21,510 --> 00:00:24,000 directories and commands on the system. 12 00:00:24,000 --> 00:00:26,250 Each account is going to be referenced by the system 13 00:00:26,250 --> 00:00:28,860 using a UID or user ID 14 00:00:28,860 --> 00:00:31,200 rather than a person's actual name. 15 00:00:31,200 --> 00:00:33,660 Now there are three different types of user accounts. 16 00:00:33,660 --> 00:00:34,920 We have the root account, 17 00:00:34,920 --> 00:00:36,120 we have the standard user 18 00:00:36,120 --> 00:00:37,830 and we have a service account. 19 00:00:37,830 --> 00:00:41,100 The root user account plays two roles on a Linux system. 20 00:00:41,100 --> 00:00:44,070 The first role is that of the local administrator. 21 00:00:44,070 --> 00:00:46,830 A user logged in as root can do administrative tasks 22 00:00:46,830 --> 00:00:48,330 such as password resets, 23 00:00:48,330 --> 00:00:50,070 system configuration changes, 24 00:00:50,070 --> 00:00:52,860 user account management and so much more. 25 00:00:52,860 --> 00:00:55,200 The second role played by the root user account 26 00:00:55,200 --> 00:00:56,760 is to provide a security context 27 00:00:56,760 --> 00:00:59,520 for some applications and commands to utilize. 28 00:00:59,520 --> 00:01:01,620 These applications and commands may be called 29 00:01:01,620 --> 00:01:03,300 by the system or manually entered 30 00:01:03,300 --> 00:01:05,940 by a user logged in as the root user. 31 00:01:05,940 --> 00:01:07,470 The root user account in Linux 32 00:01:07,470 --> 00:01:09,060 is significantly more powerful 33 00:01:09,060 --> 00:01:10,380 than a local administrator account 34 00:01:10,380 --> 00:01:11,730 on a Windows system though. 35 00:01:11,730 --> 00:01:13,740 So you need to be careful with it. 36 00:01:13,740 --> 00:01:14,670 For this reason, 37 00:01:14,670 --> 00:01:17,340 it is extremely bad as a security practice 38 00:01:17,340 --> 00:01:20,040 for you to log on to a system as the root user 39 00:01:20,040 --> 00:01:21,900 because if you're using those administrative credentials, 40 00:01:21,900 --> 00:01:24,480 it can take destructive action on the system 41 00:01:24,480 --> 00:01:27,120 and this can be usually irreversible. 42 00:01:27,120 --> 00:01:29,910 For example, if I was logged in as the root user 43 00:01:29,910 --> 00:01:34,710 and I enter the command rm-rf/*.* 44 00:01:34,710 --> 00:01:36,480 and I do that at the command shell, 45 00:01:36,480 --> 00:01:38,640 this is going to delete every single file 46 00:01:38,640 --> 00:01:40,020 on your system's hard drive 47 00:01:40,020 --> 00:01:41,730 and nothing is going to stop me. 48 00:01:41,730 --> 00:01:44,220 Seriously, when you're logged in as the root user, 49 00:01:44,220 --> 00:01:45,750 you have to know what you're doing 50 00:01:45,750 --> 00:01:47,940 and you have to be really careful. 51 00:01:47,940 --> 00:01:50,130 Next we have standard users. 52 00:01:50,130 --> 00:01:53,100 Now a standard user represents a regular system user 53 00:01:53,100 --> 00:01:55,110 who can log on to run applications, 54 00:01:55,110 --> 00:01:57,450 configure databases, build websites 55 00:01:57,450 --> 00:01:59,400 and do other normal tasks. 56 00:01:59,400 --> 00:02:01,170 Each user should have their own account 57 00:02:01,170 --> 00:02:03,900 and these accounts should not be shared with anybody else 58 00:02:03,900 --> 00:02:06,180 to ensure the security of your systems. 59 00:02:06,180 --> 00:02:09,300 Also, most tasks that a user should be doing on the system 60 00:02:09,300 --> 00:02:12,270 will only require standard user account privileges. 61 00:02:12,270 --> 00:02:15,180 Now, it is possible to set a standard user account 62 00:02:15,180 --> 00:02:16,920 to have administrative privileges. 63 00:02:16,920 --> 00:02:19,110 The advantage of doing this over permitting the user 64 00:02:19,110 --> 00:02:20,820 to log in as the root directly, 65 00:02:20,820 --> 00:02:22,710 is that the privileges of the standard user 66 00:02:22,710 --> 00:02:23,910 can actually be limited, 67 00:02:23,910 --> 00:02:26,160 whereas the root privileges cannot. 68 00:02:26,160 --> 00:02:28,380 This is the execution of a security practice 69 00:02:28,380 --> 00:02:30,000 known as least privilege, 70 00:02:30,000 --> 00:02:32,850 where we give users only as much access as they need to 71 00:02:32,850 --> 00:02:35,640 in order to perform certain job functions. 72 00:02:35,640 --> 00:02:37,320 Now, the third type of account we have 73 00:02:37,320 --> 00:02:39,240 is called a service account. 74 00:02:39,240 --> 00:02:41,910 Service accounts are usually specific to the service 75 00:02:41,910 --> 00:02:44,820 such as the HTTP daemon for web service 76 00:02:44,820 --> 00:02:49,020 or mySQL daemon for database services or things like that. 77 00:02:49,020 --> 00:02:50,910 Now, the key thing about these service accounts 78 00:02:50,910 --> 00:02:53,490 is that they're not set up for interactive login. 79 00:02:53,490 --> 00:02:54,870 This means they're disabled 80 00:02:54,870 --> 00:02:57,060 for a regular person to log onto them. 81 00:02:57,060 --> 00:02:58,770 And these accounts are usually going to be created 82 00:02:58,770 --> 00:03:01,500 as part of the service installation process instead. 83 00:03:01,500 --> 00:03:03,322 They're essentially just going to run in the background. 84 00:03:03,322 --> 00:03:05,910 They're often going to own the configuration files 85 00:03:05,910 --> 00:03:08,550 or executables that are associate with a given service 86 00:03:08,550 --> 00:03:10,260 like the Apache Web Service 87 00:03:10,260 --> 00:03:12,720 or the mySQL database service. 88 00:03:12,720 --> 00:03:15,120 Service accounts basically are going to run in the background 89 00:03:15,120 --> 00:03:16,800 and perform a single function. 90 00:03:16,800 --> 00:03:18,870 Like one account may be the printer service 91 00:03:18,870 --> 00:03:20,130 that runs the printer daemon. 92 00:03:20,130 --> 00:03:22,530 And this allows all the users to access and print 93 00:03:22,530 --> 00:03:24,960 to a shared printer or something like that. 94 00:03:24,960 --> 00:03:27,480 Now in Linux the user with administrative credentials 95 00:03:27,480 --> 00:03:29,370 is known as the superuser. 96 00:03:29,370 --> 00:03:32,640 And I told you, the superuser is typically named root. 97 00:03:32,640 --> 00:03:36,090 But you can really rename this to anything else you prefer. 98 00:03:36,090 --> 00:03:37,290 As I said earlier, 99 00:03:37,290 --> 00:03:39,810 it is generally considered a bad security practice 100 00:03:39,810 --> 00:03:42,300 to log onto the system as the superuser. 101 00:03:42,300 --> 00:03:43,890 So you should always log into the system 102 00:03:43,890 --> 00:03:46,860 with your non-privileged user account first. 103 00:03:46,860 --> 00:03:49,260 Now I know you've heard me say that a few times already. 104 00:03:49,260 --> 00:03:50,490 So guess what that means, 105 00:03:50,490 --> 00:03:52,230 it means it's really important 106 00:03:52,230 --> 00:03:53,850 and something you do not want to forget 107 00:03:53,850 --> 00:03:55,740 between now and exam day. 108 00:03:55,740 --> 00:03:58,140 Do not log in as the superuser. 109 00:03:58,140 --> 00:03:59,850 Bad, bad things to do. 110 00:03:59,850 --> 00:04:00,683 All right. 111 00:04:00,683 --> 00:04:02,940 Sometimes you're also going to find there's instances 112 00:04:02,940 --> 00:04:05,280 where the superuser's account permissions are needed 113 00:04:05,280 --> 00:04:07,380 in order to perform an administrative function 114 00:04:07,380 --> 00:04:08,700 such as managing users, 115 00:04:08,700 --> 00:04:11,640 configuring devices and configuring network settings. 116 00:04:11,640 --> 00:04:14,700 To do this, we need to elevate our privileges though. 117 00:04:14,700 --> 00:04:16,110 In information security, 118 00:04:16,110 --> 00:04:17,670 the principle of lease privilege 119 00:04:17,670 --> 00:04:19,829 states that users should be given no more authority 120 00:04:19,829 --> 00:04:22,650 on a system than they need to perform their job. 121 00:04:22,650 --> 00:04:24,480 If a user needs to be able to read a file 122 00:04:24,480 --> 00:04:25,680 but not write a file, 123 00:04:25,680 --> 00:04:27,780 then give them only read access. 124 00:04:27,780 --> 00:04:29,880 If a user needs to be able to restart the server 125 00:04:29,880 --> 00:04:31,500 but not reconfigure the server, 126 00:04:31,500 --> 00:04:34,410 then only give them permissions to restart that server. 127 00:04:34,410 --> 00:04:37,020 By giving the user the access they need to do their jobs 128 00:04:37,020 --> 00:04:39,360 and know more than that the system will remain 129 00:04:39,360 --> 00:04:41,280 much more secure. 130 00:04:41,280 --> 00:04:43,920 So, since I said it's a bad security practice 131 00:04:43,920 --> 00:04:46,620 to log under the server directly as the root user, 132 00:04:46,620 --> 00:04:47,880 what can we do instead 133 00:04:47,880 --> 00:04:49,260 when we need to perform functions 134 00:04:49,260 --> 00:04:51,510 that need the root user's permissions? 135 00:04:51,510 --> 00:04:53,370 Well, the best practice here 136 00:04:53,370 --> 00:04:55,500 is to log on with your standard user account 137 00:04:55,500 --> 00:04:58,560 and then elevate your permissions to root as needed. 138 00:04:58,560 --> 00:05:00,840 One way of doing this is to use the SU 139 00:05:00,840 --> 00:05:05,190 or substitute user command which is entered as SU root. 140 00:05:05,190 --> 00:05:07,860 Personally, I like to think about the SU command 141 00:05:07,860 --> 00:05:09,480 as the switch user command 142 00:05:09,480 --> 00:05:11,850 because it helps me remember what the purpose of it is. 143 00:05:11,850 --> 00:05:13,470 So if you hear me say switch user 144 00:05:13,470 --> 00:05:15,660 instead of substitute user throughout the course, 145 00:05:15,660 --> 00:05:16,980 that's just my memory aid. 146 00:05:16,980 --> 00:05:19,590 And that's what I use when I'm typing in something like SU. 147 00:05:19,590 --> 00:05:21,570 It helps me remember what I'm doing. 148 00:05:21,570 --> 00:05:24,450 The SU command will allow you to switch the user credentials 149 00:05:24,450 --> 00:05:26,700 and the su-root will switch the credentials 150 00:05:26,700 --> 00:05:28,380 to that of the root user. 151 00:05:28,380 --> 00:05:29,520 The system will then prompt you 152 00:05:29,520 --> 00:05:31,080 to enter the root user's password 153 00:05:31,080 --> 00:05:33,780 for authorization purposes and if you get it right, 154 00:05:33,780 --> 00:05:35,700 you'll be logged in as the root user 155 00:05:35,700 --> 00:05:36,990 and you can perform whatever task 156 00:05:36,990 --> 00:05:39,060 you need to on that system. 157 00:05:39,060 --> 00:05:42,000 Now, rather than granting system wide privileges, 158 00:05:42,000 --> 00:05:43,980 it's a much better security practice 159 00:05:43,980 --> 00:05:46,650 to delegate specific functions to a user. 160 00:05:46,650 --> 00:05:49,170 The sudo command or S U D O , 161 00:05:49,170 --> 00:05:51,030 is going to enable the server administrator 162 00:05:51,030 --> 00:05:53,910 to delegate specific commands to specific users 163 00:05:53,910 --> 00:05:57,060 without grading them full privileges on that server. 164 00:05:57,060 --> 00:05:59,220 To provide delegation to a user account, 165 00:05:59,220 --> 00:06:01,680 you need to list the user in this sudoers file 166 00:06:01,680 --> 00:06:04,260 which you can find in the /etc directory. 167 00:06:04,260 --> 00:06:07,800 So you'll find it at /etc/sudoers. 168 00:06:07,800 --> 00:06:10,620 This file can only be edited using the text editor 169 00:06:10,620 --> 00:06:14,730 V I S U D O which is the visudo editor. 170 00:06:14,730 --> 00:06:15,690 By doing this, 171 00:06:15,690 --> 00:06:17,190 a user or a group of users 172 00:06:17,190 --> 00:06:18,840 can be given specific commands to run 173 00:06:18,840 --> 00:06:21,000 in order to fulfill their responsibilities 174 00:06:21,000 --> 00:06:23,130 without having the full administrative power 175 00:06:23,130 --> 00:06:24,900 of the root user. 176 00:06:24,900 --> 00:06:27,990 Now, there are some Linux files that require the root user 177 00:06:27,990 --> 00:06:29,340 to be able to edit them. 178 00:06:29,340 --> 00:06:30,750 The sudoedit command, 179 00:06:30,750 --> 00:06:33,780 permits a user to edit a file with their own credentials, 180 00:06:33,780 --> 00:06:36,840 even if the file is only available to the root user. 181 00:06:36,840 --> 00:06:37,980 In addition to this, 182 00:06:37,980 --> 00:06:40,170 the user can also use their preferred text editor 183 00:06:40,170 --> 00:06:41,430 if they want to. 184 00:06:41,430 --> 00:06:43,830 But to use the sudoedit command, 185 00:06:43,830 --> 00:06:47,040 you must make an entry in the sudoers file for them. 186 00:06:47,040 --> 00:06:49,890 For example, if you add percent editors, 187 00:06:49,890 --> 00:06:54,890 all equals sudoedit/path/to/file 188 00:06:55,170 --> 00:06:57,360 as one of the lines in your soudoers file, 189 00:06:57,360 --> 00:06:59,580 it's going to allow any member of the editor's group 190 00:06:59,580 --> 00:07:01,800 to edit that file by using the command 191 00:07:01,800 --> 00:07:06,240 sudoedit/path/to/file. 192 00:07:06,240 --> 00:07:08,430 To ensure the security of the sudoers file, 193 00:07:08,430 --> 00:07:12,210 it's essential not to edit the /etc/sudoers file 194 00:07:12,210 --> 00:07:16,170 with a standard text editor like vi(m) or nano or gedit. 195 00:07:16,170 --> 00:07:19,770 Instead, you should always use the visudo command. 196 00:07:19,770 --> 00:07:22,200 This way, the system can verify the syntax 197 00:07:22,200 --> 00:07:26,460 of the /etc/sudoers file before it commits any changes 198 00:07:26,460 --> 00:07:29,070 and it enables the administrator an opportunity 199 00:07:29,070 --> 00:07:31,080 to correct any mistakes before they become 200 00:07:31,080 --> 00:07:33,360 part of the running configuration. 201 00:07:33,360 --> 00:07:36,270 Some options that you can use with the visudo command 202 00:07:36,270 --> 00:07:41,270 are the -c, -f, -s and -x options. 203 00:07:41,370 --> 00:07:43,350 The option -c is going to be used 204 00:07:43,350 --> 00:07:46,020 to check the existing sudoers file for errors. 205 00:07:46,020 --> 00:07:47,940 The dash -f option is going to be used 206 00:07:47,940 --> 00:07:49,710 to edit or check a sudoers file 207 00:07:49,710 --> 00:07:52,410 in a different location than the default location. 208 00:07:52,410 --> 00:07:54,240 The -s option is going to be used 209 00:07:54,240 --> 00:07:56,730 to check the sudoers file in strict mode. 210 00:07:56,730 --> 00:07:58,440 This means that any other name 211 00:07:58,440 --> 00:08:00,360 that's being used before being defined, 212 00:08:00,360 --> 00:08:02,340 is going to result in errors. 213 00:08:02,340 --> 00:08:04,890 Finally, the -x option is going to be used 214 00:08:04,890 --> 00:08:07,680 to output the sudoers file to the specified file 215 00:08:07,680 --> 00:08:09,810 in the JavaScript object notation 216 00:08:09,810 --> 00:08:12,210 or JSON formatted file type. 217 00:08:12,210 --> 00:08:14,070 Now many distributions will disable 218 00:08:14,070 --> 00:08:16,080 the actual root account for users 219 00:08:16,080 --> 00:08:18,480 and instead it allows administrative functions 220 00:08:18,480 --> 00:08:21,630 based on membership in what's known as the wheel group. 221 00:08:21,630 --> 00:08:23,100 Now members of the wheel group 222 00:08:23,100 --> 00:08:25,140 are going to exercise the administrative privileges 223 00:08:25,140 --> 00:08:27,150 of the root user with less potential 224 00:08:27,150 --> 00:08:28,770 for damaging your system. 225 00:08:28,770 --> 00:08:30,840 For example, members of the wheel group 226 00:08:30,840 --> 00:08:33,450 can use the sudo command to avoid having to sign in 227 00:08:33,450 --> 00:08:34,950 as the root user. 228 00:08:34,950 --> 00:08:37,260 You can also use the visudo command 229 00:08:37,260 --> 00:08:40,350 to edit the privileges of the wheel group if you need to. 230 00:08:40,350 --> 00:08:42,030 You can also add users to the wheel group 231 00:08:42,030 --> 00:08:43,919 to give them privileges as well. 232 00:08:43,919 --> 00:08:45,720 CentOS, which is the operating system 233 00:08:45,720 --> 00:08:46,920 we're using in this course, 234 00:08:46,920 --> 00:08:48,960 does like to rely on using the wheel group 235 00:08:48,960 --> 00:08:51,300 instead of logging in as the root user. 236 00:08:51,300 --> 00:08:54,210 Another tool to be aware of is known as polkit. 237 00:08:54,210 --> 00:08:56,670 Polkit was formally called PolicyKit. 238 00:08:56,670 --> 00:08:58,980 Now polkit is a component in Linux systems 239 00:08:58,980 --> 00:09:00,840 that controls system wide privileges 240 00:09:00,840 --> 00:09:04,020 in organized way that allows non-privileged processes 241 00:09:04,020 --> 00:09:06,060 to communicate with privileged ones. 242 00:09:06,060 --> 00:09:07,530 Up until 2012, 243 00:09:07,530 --> 00:09:09,750 this feature is actually called PolicyKit. 244 00:09:09,750 --> 00:09:11,160 And that's what it's actually referred to 245 00:09:11,160 --> 00:09:13,050 in the exam objectives has, 246 00:09:13,050 --> 00:09:15,300 but it is more accurately called polkit 247 00:09:15,300 --> 00:09:17,880 and that's what you'll hear called in the workplace. 248 00:09:17,880 --> 00:09:19,950 Now polkit allows a command to execute 249 00:09:19,950 --> 00:09:23,700 with elevated privileges using the command pkexec 250 00:09:23,700 --> 00:09:25,680 followed by the command you want to execute, 251 00:09:25,680 --> 00:09:27,960 much like the sudo command does. 252 00:09:27,960 --> 00:09:28,950 Now for example, 253 00:09:28,950 --> 00:09:31,110 let's say you want to make a directory called Jason 254 00:09:31,110 --> 00:09:33,840 underneath the root directory of your file system. 255 00:09:33,840 --> 00:09:36,000 You need to use root permissions to do that. 256 00:09:36,000 --> 00:09:40,890 So you could enter pkexec mkdir/Jason 257 00:09:40,890 --> 00:09:42,690 and this would then create the Jason directory 258 00:09:42,690 --> 00:09:44,880 using the root user's permissions. 259 00:09:44,880 --> 00:09:47,580 In general though, you're going to see that most administrators 260 00:09:47,580 --> 00:09:49,860 prefer to use sudo to execute a command 261 00:09:49,860 --> 00:09:50,970 with the root permissions, 262 00:09:50,970 --> 00:09:52,830 instead of using pkexec. 263 00:09:52,830 --> 00:09:55,050 And this is because sudo is easier to use, 264 00:09:55,050 --> 00:09:56,580 it's more flexible and it tends 265 00:09:56,580 --> 00:09:58,140 to have a better security posture 266 00:09:58,140 --> 00:10:00,453 than using pkexec in a given system.