Re: The Dangerous User

The arklinux and root users' passwords ARE disabled.. they're not 
passwordless.  Passwordless is a huge security risk because these users 
WILL be able to connect remotely on open ssh and/or telnet ports, and 
will immediately be granted access.  DISABLED passworded users cannot 
login from anywhere unless given specific rights to do so via PAM.  This 
is the case for the arklinux user, as he has permission to login on 
local console sessions.

We've actually been having discussions related to this topic lately 
because Pupeno is heading up a project that will cater to people who 
feel the need to change the default behaviour of Ark with regards to logins.

I MUST add that, as of right now, and moving forward, Ark Linux core (or 
Ark Linux Home Desktop .. whichever you want to call it) has many 
features designed around the autologin process.
We have taken the steps necessary to enable this in a secure manner.  
This means that those who do not know specifically what they are doing, 
should likely NOT attempt to change this behaviour on their own, as they 
will end up in a situation where they a) cannot login, b) will find that 
they cannot upgrade their systems, c) will find that their 'vanilla' 
users will run into many programs that either will not work or will not 
work the way they work for the arklinux user (due to permissions granted 
to arklinux which will NOT be granted to new vanilla users by default).

These are NOT bugs, they are NOT shortcomings in the system.  It's 
normal Linux behaviour for accounts which do not have proper permissions.

Pupeno's project is supposed to make some of this much easier, and will 
enable a network administrator to handle account setup, etc.  I'm not 
telling ppl NOT to switch to forced login mode, but I AM saying that it 
takes more than just clicking a radio button to effectively disable it 
and make things work without doing everything as root.

Luke wrote:

> Oh I forgot to mention, that your system was not broken. You could 
> have easily corrected the problem via the commandline in runlevel 1. 
> All you had to do was jump on irc.freenode.net #arklinux for help.
>
> I started with alpha 9 and to my knowledege the arklinux and root 
> accounts are not disable they are just passwordless and utilize 
> kapabilities. If you want them to be normal accounts you have to give 
> atleast root a password. Arklinux can be made to login without a 
> password. I know so for a fact, becuase its what I did on my system, 
> and here I am talking to you.
>
>
> I encourage you to read the mailing list and or visit irc.freenode.org 
> #arklinux, the next time you have a sever problem, that appears 
> hopeless. While it does not mean that we can fix everything in 5 mins, 
> it will atleast give you a chance at reviving your system with out 
> having to start fresh.
>
> Im sorry to hear about the problem you encountered. However there is a 
> note about it on the kdm tabs. I suppose a warning Dialouge should be 
> added to usermanagment as well. At this point in time I believe 
> usermanagment is being worked on. So Im sure they will have a look at 
> this and probably add some type of warning, that tells you to read the 
> manual if you wish to proceed.
>
>> On Mon, 9 Feb 2004 07:30:29 +0000 (UTC), uniQ 
>> <[email protected]> wrote:
>
>
>> As you may know when AL installs there are 2 users: root and 
>> arklinux. Both are
>> disabled, but arklinux logs in automatically. The problem arises that 
>> a user
>> (like me) will try to stop autologins for security or something. They 
>> then try
>> to login and... UhO! no logins are enabled!
>>
>> My ideas is for Ark to alert the user, either on quitting the user 
>> manager
>> program, the login configuration, or logging off that there are no 
>> enabled users
>> (that is, it's impossible to login).
>>
>> It can be something like this:
>>
>> Warning!
>>
>> Ark Linux has no enabled users: if you logoff, you wont be able to 
>> log back on
>> again. When you start Ark Linux, you are required to login as a user 
>> so the
>> system knows who you are and can set up your desktop and other 
>> personalized
>> stuff. If no users are enabled then then Ark Linux can't give anyone 
>> access to
>> thier programs, files, or the network or Internet. To enable a user, 
>> goto K >
>> whereever > whatever and (I don't know this, I'm used to the CLI).
>>
>> [OK]
>>
>> Thanks, my 1st Linux flavor was AL9 and my 1st install got sunk by 
>> doing that.
>>
>>        -uniQ
>>
>>
>>
>
>
>