1: No. 2: Security also depends on usability. If people won't use a security feature, then it's not actually a security feature.

if you gain remote root access and don't know what the basic commands are, just upload your own, statically compiled command set. Renaming commands is unlikely to get you much, but it'll certainly make dealing with maintaining the system nearly impossible.

Despite it not being effective, I love this question, because it shows how much effort you put in!

What you describe would be security through obscurity. Even though it is not always a bad idea, it is absolutely not suffecient. en.wikipedia.org/wiki/Kerckhoffs%27s_principle Initially this maxim applies to cryptography, though this can be easily translated to security in general. Once an attacker have knowledge of your protection, it has not much value. On the contrary, other security best practices still have benefits even when the attacker know them.

There are a couple of similar approaches that are used: "Address space layout randomisation", and (less widespread) "System call obfuscation"

maybe I've missed something, but how's the scene ludicrous?

@Kaël I agree with you in principle, but in this case you'd have to establish your case a bit more strongly, since OP is proposing renaming commands that an attacker needs, to what are essentially passwords. There is a line between security by obscurity, and proper security, since after all "once an attacker has knowledge of your protection" applies equally to passwords. You should probably post an answer to explain why in this case merely renaming everything is ineffective (and I agree that it is).

It's worth mentioning that whilst the scene may seem ludicrous, it is actually a UNIX system.

This kinda' exists. Over in the Nix world, we don't have /bin/foo; we have /nix/store/<hash>-<packagename>/bin/foo, and only packages that contain a reference to <hash> are expected to have a need to access <hash>-<packagename>/bin/foo. This is a pretty big jumpstart for anyone trying to build an access-control list, and if you don't create a symlink tree that lets folks to get to coreutils/bash/etc from a well-known location and then remove the read bit from /nix/store, you just made it a lot harder for anything that wasn't built on your system to find binaries/libraries/etc.

The risks of folks uploading their own static binaries are very real, of course. Having all writable filesystems mounted noexec makes things trickier for not-particularly-competent attackers and script kiddies, but I wouldn't trust it to hold against someone who knows what they're doing -- but then, neither would the approach proposed in this question.

@eis, who uses a 3d file browser in real life? For 2 minutes as a novelty, maybe, but it's not something that anyone would ever use to get things done; so having it as the default UI on a system when someone walks up to it? Ludicrous.

@CharlesDuffy ILM people making the Jurassic Park effects had it in their SGI workstations, and probably from where it ended up in the movie, too... so still not seeing the luricrousness

@eis, sure, but to "have something on your workstation" (say, as a novelty) is not the same as actually leaving it running when you aren't showing off or otherwise playing around. I had it installed on the IRIX boxes at college too, but did I ever use it? Not once; the shell was far more efficient.

@Kaël: You're missing the point of the "security through obscurity" point. It doesn't mean all obscurity is objectively bad; it means it's insufficient. It can be part of a defense-in-depth. For example, I think it's considered a good idea to keep internal network IP addresses obscured, not visible via public DNS.

Tim: it's Redhat, use -x. Jodi: no no, it's post-4.3.13, it's --tree=full. Velociraptor: it's POSIX compliant. Use -C. Oh, hi.

@CharlesDuffy "I had it installed on the IRIX boxes at college too, but did I ever use it? Not once". This reminds me of 3D Linux desktops like Compiz. They're cute and all, but does anyone actually use them for anything more than showing off GNOME or KDE?

Because if the only barrier to people hacking your system is that they don't know what sudo is called, you have deeper problems.

What you are suggesting is exactly what iOS (bsd based OS) and Android (linux based OS) sort of does - but instead of renaming the commands they remove them completely (requiring you to use C/Swift/Java syscalls instead)

@RonJohn "They're cute and all, but does anyone actually use them for anything" these days I'm all minimal and use i3, but back then was an in-between time: after the growth of the internet to become a serious thing that people did business with, but before modern concepts of "servers as cattle not pets" and CI and virtual hosting with AWS and so on. It was a time when I had to juggle various projects, doing multiple duties of sysadmin, DBA, full-stack dev, patches and upgrades, pitching to new clients; where having three screens with a Compiz cube on each one really helped productivity! :-D

@RonJohn "How was that more effective than having multiple virtual desktops" the hotkey to initiate spinning the cube with the mouse was something quick, like Ctrl+Alt or the Windows key. The way I had it set up was to group similar things on a cube, so I'd have four RDP sessions on my left screen, internet stuff on my right, and development and terminals in the middle. Being able to grab and spin a cube to visually identify the window I wanted was useful. I also used Alt+Tab a lot, like a normal person ;)

Generally, obfuscation works on a subset of people. I once posted the ASCII codes for "Hi. How are you?" on FB and asked friends what it meant. Most didn't have a clue. So yes, obfuscation works - up to a point. The techies quite quickly and easily solved it. Remember, this wasn't even using rot13 or something simple - it was plain ASCII. The point isn't to prevent most people from getting in. Most people don't have a clue. It's to prevent advanced people getting in - and obfuscation doesn't work on them for very long if your project is important enough to get their attention.

The problem with IoT is not so much that you don't know what the filename of sudo migt be, but that many (maybe even most?) of these are set up factory-side by people who are either wanton malicious or just outright stupid. If you can log in with admin and 123456 (and that's not an exaggeration!), or the mundane device-name is its default username and password, there's not much point worrying about anything else. Or, if you can just access the device via HTTP withought any authentication, and at the same time it tampers with your router via uPnP, for that matter. Which, too, does happen.

Fun anecdote, I have IoT devices in my very home network which are susceptible to both heartbleed and all variants of shellshock in late 2019. So it's not limited to "passwords".

Keep in mind that properly obfuscating source code of any meaningful size is actually a lot harder than it seems at first glance.

Hiding technology and ip as means for security today is a hacked method of security. That and it's not promoting of advancement of technology due to obfuscating.