Does anyone have a link to a corporate (or academic or otherwise) policy document describing the use by system administrators of interactive root shell sessions? I'm getting a bit fed up with users asking "my colours doesn't work with sudo su -" or "my root's shell session doesn't behave like my user's shell session", and I would like to be able to (possibly) point to a document saying "don't do that, silly person".
It's my personal opinion that a user should never find themselves in front of an interactive root shell prompt (unless under extraordinary circumstances).
From the point of view of a company/university, that would be really bad for at least a few reasons, security just being one of them, the ability to audit the system (see who did what) being another.
It's pretty common recommendation to open a root shell in advance of major upgrades, on the basis of not wanting to get stuck with a broken sudo/libc/... if something goes wrong
@MichaelHomer True. At my site we have "maintenance days" every month during which the system may be taken off-line without notice (hmm... that was not really related though). What I'm concerned about are users using root "just to get things done" without actually caring that it may be a really bad habit to get into.
@Kusalananda using a root shell for administrative tasks is not a problem. That's what it's for. Using a root shell for non-administrative tasks is a potential disaster (with the probability and severity inversely and exponentially proportional to the user's skill and caution).
@cas I'd be careful even about using interactive root shell for admin tasks. It's uncommon for a task to require more than a couple commands (I'm sure it depends), and those should be able to run through something like sudo (or doas on OpenBSD). That ensures that the commands are also logged.
I'd even go as far as saying that setting up aliases for root is a bad thing.
@MichaelHomer Yea in his last question he didn't mention that the variables were unset and showed the following error: bash: cd/: No such file or directory
So I had just commented that it looked like he executed cd/ instead of cd /. I don't know why that made him think I'm an expert :p
@Jesse_b I wondered about that error message. The root directory is not removed by what he did, and the cd command is a shell built-in. What's actually happening there?
@Kusalananda I agree with you. I hate being root on any server at work and I only do it when ldap is broken. I only use root on my test server because I only spun up that vm to test some things and honestly didn't expect to still have it at this point
If you have production systems that other people rely on (maybe even medical staff or similar), what sysop procedures must be in place to minimize risk?
Logging in as root and setting up aliases on colours is not something that I'd want a sysadmin to do.
You had suggested Kusalananda was taking an extreme position on root earlier. I think the common sense statement is a bit of an extreme position as well
If I have a multi user system (or several) with services running in containers here and there, some of which may have public-facing interfaces, and managing sensitive data (genomic data in my case), I'd be turning down an applicant who says "Unix is easy to administrate".
@FaheemMitha I think it's hard to define common sense. I think it's even harder to apply that term to a unix system because I would argue none of this is common knowledge.
@Jesse_b <Shrug.> Maybe so. I think I broke a Linux machine once. And that was in 1999, when I'd had less of a year of experience. And I think there was a complication with an unfortunately timed power outage.
You can choose to do crazy things. Or you can be sensible. It's your choice. But I suppose betting on people to be sensible may not be a good bet in the long term.
network operations center, although we tried to change it to COC for cloud operations center and now it's unofficially CNOC for cloud and network operations center
@Jesse_b Ah, yes. I see now. (( ... )) is mentioned in POSIX , but as an "extension".
bash handles it though.
"shells which implement an extension whereby "((expression))" is evaluated as an arithmetic expression may treat the "((" as introducing as an arithmetic evaluation instead of a grouping command."
@Jesse_b You could give an expanded solution using a loop from 1. If the value is a multiple of the value from the command line. print a string. I think this is what's asked for.
@terdon I flagged this for mods, but I'll ping you here too. See mod flagging message. I think it should remain closed, but it may be for the wrong reason. Also, we were possibly a bit too quick with closing it... unix.stackexchange.com/questions/423405/…
It's just mentioned a shortcut for and its usage is supposed to be obvious, but it isn't obvious to me. How do I even tell I "marked" something? Why would I mark something? Does this thing have a scope? Does it ever expire? And do I get a bash warning when/where it did? And above all, cool, I "se...
By the way, @Kusalananda, asking for official documentation is explicitly on topic. So even if the question were "where is this documented", that would have been fine.
Note the wording of the close reason (emphasis mine):
> Requests for learning materials (tutorials, how-tos etc.) are off topic. The only exception is questions about where to find official documentation (e.g. POSIX specifications). See the Help Center and our Community Meta for more information.
@terdon Aha! That parenthesis has had me believe that "official documentation" only refers to the POSIX documentation. I see now that this is not the way to interpret it.
@Kusalananda The close reason is quite obviously not very clear seeing how many users misunderstand it. I really need to open a new meta for this when I get the chance. But yeah, the POSIX is just an example, hence the "e.g." :)
The rule of thumb is: is the question something that can be answered here? The it's fine. Is it instead asking for video tutorials or some such? Then close. You can see the meta discussion linked in the close reason to understand the history of it and the rationale.
We recently had a brief discussion in chat about this question which asks for learning materials (specifically, online video courses). I feel that such questions are not a good fit for the site because:
They are not about a problem. The SE network specializes in giving specific solutions to spe...
@JeffSchaller Not really, but closer to 45 than to 44 (the birthdays, that is). It's not until May :-)
I feel like 50 though...
@JeffSchaller Phew, I'm not alone!
@JeffSchaller I was updating it a tiny bit anyway, so I thought I'd increment the age or I'll forget it. And it's such an important piece of info too... :-)
I just removed the text 0 down vote favorite from a handful of questions. I wonder where that came from. Copy & paste from the web?
@Kusalananda mine are regularly called things like "puke-beast" (with optional "wretched" modified, depending on what, exactly, they puked on). I suppose having a hair-trigger vomit reflex is a useful survival adaptation for a hunter-scavenger. Fortunately they almost never crap or piss anywhere they're not supposed to.
