Managing User Accounts in Lindows

Although Lindows doesn't require user accounts, it's a good idea to create them anyway--here's why and how to do it.

Lindows, a distribution of Linux, does not require you to set up user accounts; by default you log in as the Administrator. This article explains why you should have user accounts anyway and how to manage them. Experienced Linux users can safely skip ahead to the Setting Up Accounts section.

Too Much Power

Before you can use a Linux system, you need to log in using a user account. A user account is a record that the system keeps for each user to record system data about that user, such as the user's password. The account is linked to a user name that is unique on a Linux system. The system checks the user account data to decide whether to grant or deny each user access to files and devices on the system.

A special account called root can be found in any Linux or other UNIX-based system. The Lindows login manager calls this account Administrator. Sometimes the root account is called the Super-User account. This account has full permission over the system--it can do almost anything.

In most situation, when you are logged in using the root account you have too much power. You can delete or overwrite any file on the system and possibly make the system stop working correctly. If someone can trick you into running a program or if a virus somehow runs while you are logged in, that program then has the ability to do anything at all; it could actually take over your system. In short, running as root is dangerous.

User Accounts

The alternative to running as root is to run as a user. Technically, root is a user too, but usually we refer to root and users as separate entities. When you are running as a user, you greatly reduce your ability to harm your system.

Every user account has a unique user ID, a number that identifies each specific user. The root user always has a user ID of zero; other user numbers vary. When you are logged in as a user, any program you use runs under your user ID, and the system checks that user ID to decide whether the program is allowed to do certain tasks.

Each user account also has a unique user name, sometimes called the login name. For the root account this name is always root. The user name can be anything, however. I use steveha on my home system, but I could be coolguy or some other nickname. User names should be short (no more than 8 or 10 letters) and contain numbers and lower-case letters; I do not recommend the use of upper-case letters or punctuation in user names.

Each user has a directory assigned to it, the home directory, over which the user has full permissions. The user's settings are stored in configuration files, which are kept in the home directory. By convention, the home directory is in /home and has the same name as the user name. So a user named coolguy would have /home/coolguy for a home directory.

Occasionally, you may discover that something doesn't work because you don't have permission to use it. For example, if your user account doesn't have permission to use the sound card in your Linux system, you aren't able to play music. But most Linux systems, including Lindows, do a good job of setting up user accounts with the permissions they need.

A Little Bit Root

Because it's dangerous to run as root all the time, there are ways to access the power of the root account while logged in as a user. For example, you can run a command shell and switch only that command shell to run as root. A command called su switches user identities for a particular command-shell session. By default, it switches to the root user, but you can also use it to switch to another user identity. For security, you need to type the account password when switching with su. su actually opens a new shell inside your original command shell, so when you exit from the su shell you find yourself back in your original command shell.

If you want to run only one command as root, you can use sudo to run a single command as another user. If your usual command shell is Bash, then this command would do exactly the same thing as the su command:

# sudo bash

Graphical versions of sudo are available, too. Most of them don't have sudo in their name, only su. KDE has kdesu, GNOME has gnomesu and there are others.

Groups

Groups add another level of security to a Linux system. A group is a set of users who collectively can be given permissions. For example, access to the sound card is controlled by a group called audio, and any user who wants to be able to use the sound card needs to be in the audio group. Each group has a unique group ID, analogous to the user ID number, and a unique name, analogous to the user name.

A Linux system can assign permissions based on user ID or group ID. Anytime more than one user might want to access a file or device, it makes sense to use group permissions. For example, at a company where many people share a Linux server, the Project X team might have a group called projectx. All members of the Project X team then are added to the projectx group. All the secret files belonging to Project X would be made accessible only to the members of the projectx group.

You can use the Lindows File Manager, which actually is a KDE program called Konqueror, to make a file accessible to the members of only one particular group. Right-click on the file in the File Manager, and choose Properties from the right-click menu. Click on the Permissions tab, and then in the Ownership box, edit the Group field to specify the desired group. Then use the Access Permissions checkboxes to make sure only members of the specified group can access the file: make sure the Group permission bits for read and write are the only ones checked.

You can make a directory accessible to members of only a single group using the same technique. For a directory, the execute permission bit controls permission to access that directory; the read bit controls permission to view the contents of the directory; and the write bit controls permission to create new files in the directory.

You can find many tutorials on the Web that outline how to manage a Linux system by using user accounts, group accounts and permission bits. Almost all of them explain how to use command-line tools to change the settings. In Lindows, however, you actually can do most management tasks from the Lindows desktop, using the User Manager and the File Manager.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Re: Managing User Accounts in Lindows

Anonymous's picture

Thanks for the really helpful article Steve! If anyone has trouble with permissions while running under a user account please send email to support@lindows.com.

Kendall Dawson
(Community Liaison)

kendall@lindows.com

Why is root the default?

Anonymous's picture

Running with root permissions by default is dangerous. It is just to easy for a home user to delete /usr or whatever.

So why not set-up a non-root user by default? Make it called "user", with a UID of 1000 (note to redhat users: this is debian. See debian guidelines). Allow even renaming it later (that may be tricky. Should be tested. The name is listed in too many places, I figure).

You don't want to confuse the user with an extra prompt for password? No problems: use the root password. OTOH, if the user has an emptypassword I would tend to deny any remote access to that account.

Does this complicate the user interface much? No. Not a bit.

Does this give a more error-proof system? Sure

Home users

Anonymous's picture

What a fascinating set of discussions going on here. A lot of contrasts being highlighted here - between Linux and Windows, between geeks and non-geeks, between home users and IT users.

Aside from Lindows, there really has been little or no effort to market Linux toward home users (not that the Micorsoft monopoly allows the home user much exposure to Linux, but still). The first thing we geeks need to remember is that Linux, based on Unix as it is, is designed inherently for a setting where you have a number of users sharing the system, which is controlled by a system administrator. In any multiuser system, it is not always a foregone conclusion that you can trust your users - thus the need to limit the abilities of users and give the unlimited power of root only to the system administrator.

The folks who are suggesting that Linux makes them "jump through hoops" for security, or the person who says that the segregation of root somehow limits what they can do on their computer, are clearly not system administrators who face the problem of multiple, possibly untrusted users. We need to remember that. These are clearly average-joe, non-geek home users - the kind of people that use their computers for e-mail, to play games, balance their checkbooks, and maybe let their kids do their homework or chat online with their friends, and be done with them. These people have probably used old versions of Windows for years, and have been fully immersed in the old Microsoft philosophy of non-existent security and lack of multiuser support in their home products.

A few of the comments above from other LJ readers clearly illustrates the uphill battle Linux users face in educating the public about safe computing, and the damage Microsoft has wrought in that same area. *Of course* not using the root account unless you absolutely have to is good practice - common sense tells us that. *Of course* you want to create a separate area on your system for yourself as a user so that something stupid you do to your computer doesn't harm the system. Those are basic elements of the Unix philosophy, and good computing practice to boot. But Microsoft has trained its customers differently - and maybe they didn't set out specifically to do that, but they did. Linux is already in the process of conquering the server space, and the business desktop is next - but after that will come the home users, and in this realm we aren't going to have to convince IT managers. We'll need to convince non-geek users who can't understand why they need to create a "user" account for themselves on Linux when they never did on Windows, or why you need to enter a password before you can install new software.

I'm glad Lindows is taking the first few steps to reach out to the home user, but perpetuating the poor practices of the Win9x way of doing things is not the way to go. Educating the user, not dumbing the system down and eliminating its first line of defense, is the proper course of action, and one I hope Lindows addresses in future versions of their distribution.

It seems...

Anonymous's picture

...most of you don't get it.

Security DOES matter, just as much for home users as it does anywhere. Especially if they have a constent network connection (broadband).

The problem in this instance is Lindows, NOT Linux.

NO users should not have to go through this process, the install or first time you boot the computer should be asking you to do this and guiding you through it.

You idiots claiming how "Windows gets it" need to wake up!
Why do you think Microsoft is pushing it's new security initiatives...they have quoted in the past that they SACRIFICED SECURITY IN FAVOR OF EASE OF USE AND FEATURES!!! and now they are paying for it. Thinks
at MS are changing, why make Linux (in terms of security) just like OLD versions of Windows?

The ideal thing is to create a system that balances security and ease of use...with out sacrificing too much of either.

So how should we do it? Well look at Ark Linux and MacOS X...neither system let you run as root by default and are dead easy to use.

I have been working on an article about this very thing at my website, it's *almost* finished so you can read it here:

Desktop Security

911

Anonymous's picture

After 911 did the airlines do the smart thing and simply figure out how to secure the cockpit? NO! Instead, they waste millions of hours of productivity every day in time spent making every traveler go through an extensive screening process. There are SMART and DUMB ways to make something secure. The airlines do it in an inefficient, dumb way, by making it annoying to travel.

I agree with the earlier post that computers need to get smarter, not the user. Technology should work for us, not the other way around.

Would it be bad if people were smarter about technology? No, of course not, but people don't buy computers to create more work. They want the computer to invisibly do what it needs to do. Geeks love creating more work on the computer. Unfortunately for Linux, 95% of the world aren't geeks and don't live to compute. They just want to get their work (or play) done, not feel like they are James Bond going through a security clearance every time they want to change the wallpaper on their computer.

I agree, this is where MS has it all over Open Source. I think users should have total control over their computers and have the choice of what they want to do, without having a Linux geek snubbing their nose at them for not wanting to have to take a class on how to use their computer.

/z

Good...but...

Anonymous's picture

I think this is a useful article helping educate people about security and what options they have. Where Linux geeks always go over the top is with their religious table pounding about the right and wrong way to do things--like anyone that runs as root is going to burn in hell. It's that fanaticism that keeps non-geeks away from Linux and why Microsoft doesn't have anything to worry about when it comes with Linux on the desktop.

The average DESKTOP computer user doesn't want to jump through a bunch of hoops. Microsoft understands this. Linux geeks don't have a clue.

Maybe Lindows will find the best of both worlds.

Tim G

Re: Good...but...

Anonymous's picture

Yes, it's called Ark Linux or MacOS X

Lindows has it all wrong.

Re: Managing User Accounts in Lindows

Anonymous's picture

I saw an experienced knowledgeable admin enter the following command in haste: rm -r /etc

It's not what he wanted to do, he wanted to delete the copy of etc that he had in his home directory, unfortunately the "." key was sticky and he was logged in as root.

It was just a matter of restoring it from tape, and fortunately he didn't log out!

Practice safe computing or you'll just have yourself to blame.

Missing the Point

Anonymous's picture

It's nice to see the authors of the previous comments completely missing the point. Yes, you paid for your computer and you want all the power, whatever that means. Well, so what? Sometimes, you make mistakes (yes, even you!), like removing files by accident or copying over something you shouldn't have. It's at those times that running at a level where such mistakes don't completely trash your installation can be a big benefit.

Now, I don't necessarily think that everyone should go out and create hundreds of users to cover every different service they're running (although a lot of those users should actually be set up by the people who put the distro together), but running as root isn't using "the power" - it's like driving down the interstate with your seatbelt unfastened, claiming that you won't have your "freedom" curtailed.

Too much power?

Anonymous's picture

Hello? I OWN my computer. I don't like people telling me that I would have "too much power" when I run MY computer.

I WANT all the power I paid for. I agree that if I'm going to let someone else use my computer (which I personally almost never do) that it makes sense for me to set them up a user account. But, when I am using MY computer, I'm not going to purposely strip away my "power."

I don't want to have to type in a password to change the time on my computer. I paid for this sucker and I'll keep ALL THE POWER I can, thank you very much.

dj

Re: Too much power?

Anonymous's picture

"Hello? I OWN my computer. I don't like people telling me that I would have "too much power" when I run MY computer."

Running from user accounts does not take away your power as the owner of your computer.

It takes power away from every attacker that finds a security flaw in your web browser, mail client, IM client, etc...

For parents it gives more control to limit what the kids can access and to keep them from screwing up the computer outside of the account they run from with software they install, internet sites they visit, settings they change, etc...

Any pain involved in running LindowsOS from a user account is the fault of Lindows.com. They could easily make the default setup for a user account include the necessary group memberships for audio, video acceleration, CD Burning, etc... And with a little work provide tools that are simple for the average user to understand to manage access for various tasks.

The same thing applies to Windows. The failure to have more user access levels than Administrator and Limited User and the lack of an easy to understand way to create and manage user access levels rests with MicroSoft.

Re: Too much power?

steveha's picture

Sure, it's your computer. You can still access the full power of root whenever you need it. In the article, I even tell you how to access root power just for one command.

If you run as root all the time then the system cannot protect you from any mistake you might make. If you accidentally typed a command that erased every file in /etc, or /boot, that would mess up your computer big-time... if you ran that command as root; if you ran it as a user, nothing would happen except an error message.

In day-to-day use of the computer, you don't need the power of root. You just need to be able to run your web browser, email client, word processor, games, etc. And you can do all that without running as root.

Once your system is set up, you rarely need to do anything as root. The exception is to install software, but Click-N-Run does that on Lindows, and it will prompt you for the root password so you still don't need to be logged in as root.

steveha

Re: Too much power?

Anonymous's picture

Then you're an idiot, and deserve to break your lovely powerful computer.

And when you do, guess what? You get to keep both pieces!

Muppet...

Re: Too much power?

Anonymous's picture

Is this a joke? No, really, are you joking?

Open up a terminal window on your Lindows box, typerm -rf /and enjoy that rush of power!

This is why people don't use Linux

Anonymous's picture

This is why people are affraid to use Linux. You scare people into thinking they need to do all this stuff to have a secure computer.

Everyone talks about how much better Linux is than MS Windows. To me, I see no difference. MS Windows isn't all that secure, but either is Linux apparently, unless you jump through a bunch of hoops.

Shouldn't we try to make computers smarter than this? Shouldn't we make software that keeps a computer secure WITHOUT the user jumping through hoops right and left????

We can do better than this guys! Linux should be smarter, not just require more hoop jumping.

Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.

Roger

Re: This is why people don't use Linux

steveha's picture

Everyone talks about how much better Linux is than MS Windows. To me, I see no difference.

MS Windows 2000, and Windows XP, by default set up an "administrator" account (same idea as the root account in *NIX) and one or more "user" accounts. Same exact idea. It's just that Windows sets it up for you, while Lindows makes you do the setup.

It will probably take you longer to read the article than to set up a couple of user accounts. It's not a big deal!

I do think Lindows should, as recent versions of Windows do, set up at least one user account and make the user run in that by default.

Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.

No, Lindows.com just disables most of the security features in Linux by default. That's certainly a convenient way to set up a system, but it drastically increases the risk from mistakes or viruses or Trojan Horse programs.

At least it is possible to set up user accounts in Lindows 4.0; otherwise I would have given it a "not recommended" in my review.

steveha

Re: This is why people don't use Linux

Anonymous's picture

I have tried Diffrent Linux Systems for the last 2 years and right now Lindows ....!

The bottom line is Linux is a hassle and every version i have tried from redhat 9 ect susie ect ,,,,,all the rest all have flaws of one kind or another.. its the sound or the video ect...bla bla bla ...

BOTTOM LINE IS LINUX SUCKS....!

Re: This is why people don't use Linux

Anonymous's picture

You are right, users shouldn't have to do all this...it should be easier...but that is Lindows fault not Linux in general

and yes, security DOES matter!

Re: This is why people don't use Linux

Anonymous's picture

Wow...it's September on the Linux Journal comment board!
This is why people are affraid to use Linux. You scare people into thinking they need to do all this stuff to have a secure computer.
They do need to do all this stuff to have a secure computer...
Everyone talks about how much better Linux is than MS Windows. To me, I see no difference. MS Windows isn't all that secure, but either is Linux apparently, unless you jump through a bunch of hoops.
Regrettably, it's true, you do have to take a few precautions to keep your computer secure. One of which is setting up a user account so you don't accidentally delete your entire system, something I guarantee you the "I WANT MY POWER" guy below is going to do in the near future.
Shouldn't we try to make computers smarter than this? Shouldn't we make software that keeps a computer secure WITHOUT the user jumping through hoops right and left????
I can't wait to see what you're going to come up with! (You are programming this miracle OS, right?)
Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.
Yeah, the last thing we want is smarter users! By the way, how does disabling the most basic security feature of the system (segregating the unlimited power of the root account from day-to-day user activity) indicate that Lindows is "training the software to be smarter"? I'm just not seeing it.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState