You will get 10 different answers from 10 different people. There are merits to both sudo and regular root access. The proper way to use sudo as I've learned is to use it to grant specific commands to individual groups. Global sudo is just plain root access. While your root you may have a decent password on it, many will use a simple short easy to remember and share their user password. This greatly exposes full root access in the process. Here is an example of my sudo config. None of the users on my system are in the sudo group. I have the root password. This is a config file to limit a certain group to very specific commands that I need without fully exposing everything.
With this I can do basic maintenance and such without having to ever actually use root. It also prevents anyone with my password from doing any kind of damage outside of potential privilege escalation attacks that I'm unaware of thus far. I can also add anyone in my family to this group to allow them to do basic maintenance and still have no real power to speak of to the whole of the system. There is no real reason to switch to a TTY as far as I'm concerned but same as sudo, 10 different answers from 10 different people.
I also make extensive use of the staff group in /usr/local. This way I can download the occasional binary like vscode and put it in without needing root privileges. It is under my permissions so it theoretically shouldn't be able to do anything yet still global if any other user on the system would need or want to use it. Same thing with my c programming (entry level) stuff. My makefile for a library I've been working on installs to /usr/local{lib,include}. No need for root access for any of this.
Code:
cat /etc/sudoers.d/daytoday Cmnd_Alias UPDATE_CMDS = /usr/bin/apt update, /usr/bin/apt upgrade, /usr/bin/apt cleanCmnd_Alias BACKUP_CMDS = /usr/bin/systemctl start userbackups.service# daily maintenance junk%daytoday ALL = UPDATE_CMDS, BACKUP_CMDSI also make extensive use of the staff group in /usr/local. This way I can download the occasional binary like vscode and put it in without needing root privileges. It is under my permissions so it theoretically shouldn't be able to do anything yet still global if any other user on the system would need or want to use it. Same thing with my c programming (entry level) stuff. My makefile for a library I've been working on installs to /usr/local{lib,include}. No need for root access for any of this.
Statistics: Posted by jmgibson1981 — 2023-12-26 02:31 — Replies 1 — Views 38