Managing User Accounts in Lindows

Although Lindows doesn't require user accounts, it's a good idea to create them anyway--here's why and how to do it.
Resources

Lindows Web site

Lindows support site

Lindows discussion forums

Controlling access to files using user and group permissions

Lindows is based on the Debian GNU/Linux distribution. Debian GNU/Linux System Administrator's Manual

Steve R. Hastings first used UNIX on actual paper teletypes. He enjoys bicycling with his wife, listening to music, petting his cat and making his Linux computers do new things.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Re: Managing User Accounts in Lindows

Anonymous's picture

Thanks for the really helpful article Steve! If anyone has trouble with permissions while running under a user account please send email to support@lindows.com.

Kendall Dawson
(Community Liaison)

kendall@lindows.com

Why is root the default?

Anonymous's picture

Running with root permissions by default is dangerous. It is just to easy for a home user to delete /usr or whatever.

So why not set-up a non-root user by default? Make it called "user", with a UID of 1000 (note to redhat users: this is debian. See debian guidelines). Allow even renaming it later (that may be tricky. Should be tested. The name is listed in too many places, I figure).

You don't want to confuse the user with an extra prompt for password? No problems: use the root password. OTOH, if the user has an emptypassword I would tend to deny any remote access to that account.

Does this complicate the user interface much? No. Not a bit.

Does this give a more error-proof system? Sure

Home users

Anonymous's picture

What a fascinating set of discussions going on here. A lot of contrasts being highlighted here - between Linux and Windows, between geeks and non-geeks, between home users and IT users.

Aside from Lindows, there really has been little or no effort to market Linux toward home users (not that the Micorsoft monopoly allows the home user much exposure to Linux, but still). The first thing we geeks need to remember is that Linux, based on Unix as it is, is designed inherently for a setting where you have a number of users sharing the system, which is controlled by a system administrator. In any multiuser system, it is not always a foregone conclusion that you can trust your users - thus the need to limit the abilities of users and give the unlimited power of root only to the system administrator.

The folks who are suggesting that Linux makes them "jump through hoops" for security, or the person who says that the segregation of root somehow limits what they can do on their computer, are clearly not system administrators who face the problem of multiple, possibly untrusted users. We need to remember that. These are clearly average-joe, non-geek home users - the kind of people that use their computers for e-mail, to play games, balance their checkbooks, and maybe let their kids do their homework or chat online with their friends, and be done with them. These people have probably used old versions of Windows for years, and have been fully immersed in the old Microsoft philosophy of non-existent security and lack of multiuser support in their home products.

A few of the comments above from other LJ readers clearly illustrates the uphill battle Linux users face in educating the public about safe computing, and the damage Microsoft has wrought in that same area. *Of course* not using the root account unless you absolutely have to is good practice - common sense tells us that. *Of course* you want to create a separate area on your system for yourself as a user so that something stupid you do to your computer doesn't harm the system. Those are basic elements of the Unix philosophy, and good computing practice to boot. But Microsoft has trained its customers differently - and maybe they didn't set out specifically to do that, but they did. Linux is already in the process of conquering the server space, and the business desktop is next - but after that will come the home users, and in this realm we aren't going to have to convince IT managers. We'll need to convince non-geek users who can't understand why they need to create a "user" account for themselves on Linux when they never did on Windows, or why you need to enter a password before you can install new software.

I'm glad Lindows is taking the first few steps to reach out to the home user, but perpetuating the poor practices of the Win9x way of doing things is not the way to go. Educating the user, not dumbing the system down and eliminating its first line of defense, is the proper course of action, and one I hope Lindows addresses in future versions of their distribution.

It seems...

Anonymous's picture

...most of you don't get it.

Security DOES matter, just as much for home users as it does anywhere. Especially if they have a constent network connection (broadband).

The problem in this instance is Lindows, NOT Linux.

NO users should not have to go through this process, the install or first time you boot the computer should be asking you to do this and guiding you through it.

You idiots claiming how "Windows gets it" need to wake up!
Why do you think Microsoft is pushing it's new security initiatives...they have quoted in the past that they SACRIFICED SECURITY IN FAVOR OF EASE OF USE AND FEATURES!!! and now they are paying for it. Thinks
at MS are changing, why make Linux (in terms of security) just like OLD versions of Windows?

The ideal thing is to create a system that balances security and ease of use...with out sacrificing too much of either.

So how should we do it? Well look at Ark Linux and MacOS X...neither system let you run as root by default and are dead easy to use.

I have been working on an article about this very thing at my website, it's *almost* finished so you can read it here:

Desktop Security

911

Anonymous's picture

After 911 did the airlines do the smart thing and simply figure out how to secure the cockpit? NO! Instead, they waste millions of hours of productivity every day in time spent making every traveler go through an extensive screening process. There are SMART and DUMB ways to make something secure. The airlines do it in an inefficient, dumb way, by making it annoying to travel.

I agree with the earlier post that computers need to get smarter, not the user. Technology should work for us, not the other way around.

Would it be bad if people were smarter about technology? No, of course not, but people don't buy computers to create more work. They want the computer to invisibly do what it needs to do. Geeks love creating more work on the computer. Unfortunately for Linux, 95% of the world aren't geeks and don't live to compute. They just want to get their work (or play) done, not feel like they are James Bond going through a security clearance every time they want to change the wallpaper on their computer.

I agree, this is where MS has it all over Open Source. I think users should have total control over their computers and have the choice of what they want to do, without having a Linux geek snubbing their nose at them for not wanting to have to take a class on how to use their computer.

/z

Good...but...

Anonymous's picture

I think this is a useful article helping educate people about security and what options they have. Where Linux geeks always go over the top is with their religious table pounding about the right and wrong way to do things--like anyone that runs as root is going to burn in hell. It's that fanaticism that keeps non-geeks away from Linux and why Microsoft doesn't have anything to worry about when it comes with Linux on the desktop.

The average DESKTOP computer user doesn't want to jump through a bunch of hoops. Microsoft understands this. Linux geeks don't have a clue.

Maybe Lindows will find the best of both worlds.

Tim G

Re: Good...but...

Anonymous's picture

Yes, it's called Ark Linux or MacOS X

Lindows has it all wrong.

Re: Managing User Accounts in Lindows

Anonymous's picture

I saw an experienced knowledgeable admin enter the following command in haste: rm -r /etc

It's not what he wanted to do, he wanted to delete the copy of etc that he had in his home directory, unfortunately the "." key was sticky and he was logged in as root.

It was just a matter of restoring it from tape, and fortunately he didn't log out!

Practice safe computing or you'll just have yourself to blame.

Missing the Point

Anonymous's picture

It's nice to see the authors of the previous comments completely missing the point. Yes, you paid for your computer and you want all the power, whatever that means. Well, so what? Sometimes, you make mistakes (yes, even you!), like removing files by accident or copying over something you shouldn't have. It's at those times that running at a level where such mistakes don't completely trash your installation can be a big benefit.

Now, I don't necessarily think that everyone should go out and create hundreds of users to cover every different service they're running (although a lot of those users should actually be set up by the people who put the distro together), but running as root isn't using "the power" - it's like driving down the interstate with your seatbelt unfastened, claiming that you won't have your "freedom" curtailed.

Too much power?

Anonymous's picture

Hello? I OWN my computer. I don't like people telling me that I would have "too much power" when I run MY computer.

I WANT all the power I paid for. I agree that if I'm going to let someone else use my computer (which I personally almost never do) that it makes sense for me to set them up a user account. But, when I am using MY computer, I'm not going to purposely strip away my "power."

I don't want to have to type in a password to change the time on my computer. I paid for this sucker and I'll keep ALL THE POWER I can, thank you very much.

dj

Re: Too much power?

Anonymous's picture

"Hello? I OWN my computer. I don't like people telling me that I would have "too much power" when I run MY computer."

Running from user accounts does not take away your power as the owner of your computer.

It takes power away from every attacker that finds a security flaw in your web browser, mail client, IM client, etc...

For parents it gives more control to limit what the kids can access and to keep them from screwing up the computer outside of the account they run from with software they install, internet sites they visit, settings they change, etc...

Any pain involved in running LindowsOS from a user account is the fault of Lindows.com. They could easily make the default setup for a user account include the necessary group memberships for audio, video acceleration, CD Burning, etc... And with a little work provide tools that are simple for the average user to understand to manage access for various tasks.

The same thing applies to Windows. The failure to have more user access levels than Administrator and Limited User and the lack of an easy to understand way to create and manage user access levels rests with MicroSoft.

Re: Too much power?

steveha's picture

Sure, it's your computer. You can still access the full power of root whenever you need it. In the article, I even tell you how to access root power just for one command.

If you run as root all the time then the system cannot protect you from any mistake you might make. If you accidentally typed a command that erased every file in /etc, or /boot, that would mess up your computer big-time... if you ran that command as root; if you ran it as a user, nothing would happen except an error message.

In day-to-day use of the computer, you don't need the power of root. You just need to be able to run your web browser, email client, word processor, games, etc. And you can do all that without running as root.

Once your system is set up, you rarely need to do anything as root. The exception is to install software, but Click-N-Run does that on Lindows, and it will prompt you for the root password so you still don't need to be logged in as root.

steveha

Re: Too much power?

Anonymous's picture

Then you're an idiot, and deserve to break your lovely powerful computer.

And when you do, guess what? You get to keep both pieces!

Muppet...

Re: Too much power?

Anonymous's picture

Is this a joke? No, really, are you joking?

Open up a terminal window on your Lindows box, typerm -rf /and enjoy that rush of power!

This is why people don't use Linux

Anonymous's picture

This is why people are affraid to use Linux. You scare people into thinking they need to do all this stuff to have a secure computer.

Everyone talks about how much better Linux is than MS Windows. To me, I see no difference. MS Windows isn't all that secure, but either is Linux apparently, unless you jump through a bunch of hoops.

Shouldn't we try to make computers smarter than this? Shouldn't we make software that keeps a computer secure WITHOUT the user jumping through hoops right and left????

We can do better than this guys! Linux should be smarter, not just require more hoop jumping.

Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.

Roger

Re: This is why people don't use Linux

steveha's picture

Everyone talks about how much better Linux is than MS Windows. To me, I see no difference.

MS Windows 2000, and Windows XP, by default set up an "administrator" account (same idea as the root account in *NIX) and one or more "user" accounts. Same exact idea. It's just that Windows sets it up for you, while Lindows makes you do the setup.

It will probably take you longer to read the article than to set up a couple of user accounts. It's not a big deal!

I do think Lindows should, as recent versions of Windows do, set up at least one user account and make the user run in that by default.

Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.

No, Lindows.com just disables most of the security features in Linux by default. That's certainly a convenient way to set up a system, but it drastically increases the risk from mistakes or viruses or Trojan Horse programs.

At least it is possible to set up user accounts in Lindows 4.0; otherwise I would have given it a "not recommended" in my review.

steveha

Re: This is why people don't use Linux

Anonymous's picture

I have tried Diffrent Linux Systems for the last 2 years and right now Lindows ....!

The bottom line is Linux is a hassle and every version i have tried from redhat 9 ect susie ect ,,,,,all the rest all have flaws of one kind or another.. its the sound or the video ect...bla bla bla ...

BOTTOM LINE IS LINUX SUCKS....!

Re: This is why people don't use Linux

Anonymous's picture

You are right, users shouldn't have to do all this...it should be easier...but that is Lindows fault not Linux in general

and yes, security DOES matter!

Re: This is why people don't use Linux

Anonymous's picture

Wow...it's September on the Linux Journal comment board!
This is why people are affraid to use Linux. You scare people into thinking they need to do all this stuff to have a secure computer.
They do need to do all this stuff to have a secure computer...
Everyone talks about how much better Linux is than MS Windows. To me, I see no difference. MS Windows isn't all that secure, but either is Linux apparently, unless you jump through a bunch of hoops.
Regrettably, it's true, you do have to take a few precautions to keep your computer secure. One of which is setting up a user account so you don't accidentally delete your entire system, something I guarantee you the "I WANT MY POWER" guy below is going to do in the near future.
Shouldn't we try to make computers smarter than this? Shouldn't we make software that keeps a computer secure WITHOUT the user jumping through hoops right and left????
I can't wait to see what you're going to come up with! (You are programming this miracle OS, right?)
Seems to me that Lindows.com understands this and is trying to train the software to be smarter, not the user.
Yeah, the last thing we want is smarter users! By the way, how does disabling the most basic security feature of the system (segregating the unlimited power of the root account from day-to-day user activity) indicate that Lindows is "training the software to be smarter"? I'm just not seeing it.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState