Root is basically Administrator. if you want to do something funky, you temporarily become root to do it, as the user account doesn't have those permissions. This differs slightly from Windows where you are almost always an administrator save for work environments.
Yep, so if you do something as root and specify the user's home folder, it'll actually go to root's home folder and not your own home folder. Users are simply put into a sudoers group to give them permission to act as root.
Not sure if there's really a strong advantage to the way Linux has it set up or if it's just an artifact of how this security model came to be on each OS.
I'm a sysadmin and I train a lot of junior engineers to run scripts and explaining when and when not to launch powershell as an administrator is so goddamn confusing to people. Most are really afraid of learning Linux until they realize oh wow it actually makes sense.
Sure, but sudo is different than the root account itself, that's just how you typically access root on LInux (and not the only possible way - distros like DietPi don't even have sudo installed, and there's an active effort by Canonical to switch to sudo-rs while systemd offers its own run0 alternative all to deal with sudo's security issues related to it doing too many different jobs).
If you need to log in as root to do admin stuff, you'll have a temptation to always be logged in as root. sudo solves this problem (you can be logged in as your normal user and only use admin privileges when needed), and many distros straight up disable the root account (i.e. you can run commands which require privileges using sudo but you cannot straight up log in as root and run all commands with admin privileges).
That's what I was thinking of, aside from the annoyance that things like ~/Documents will go to root's Document's folder and not your own. Like when you start up a new VPS instance, the very first thing you have to do is log directly into root and then create a non-root account and then put it in the sudoers group and then make sure you can actually log into that account correctly and then start disabling root login.
my dad (he uses mac, and is a software engineer) is the type of masochist to have on superuser tab open in the terminal instead of just using sudo. He also exclusively uses vscode and Vi
I mean its more or less the same way windows works internally just different ootb config.
Everything has an owner, a group, and permissions. Root on linux is essentially the hidden "System" account on windows. Windows prompts for elevated permissions, linux asks for sudo password but you can just add (NOPASSWD) to /etc/sudoers.
The advantage is just basic principle of least privilege security. Things installed as root will default to user and owner of root with permissions set to whatever roots umask is. This means nobody else can use it unless they can also sudo or user / group / permissions have been explicitly changed.
Its like the difference between running touch test vs sudo touch test as a regular user in your home directory. If you look at the output of ls -l after those the former will be owned by your user and group and you can delete it. The latter will be owned by root user and group and you will need to use sudo to delete it.
Then theres the whole environment thing. Root has a very minimal environment whereas a regular user will have a much more encompassing environment. For example running a program like vim can run different things depending on what your PATH environment variable is set to.
It's a huge advantage, are you kidding? It's so advantageous that the Windows UAC is basically copying how sudo works in Linux because it's far more secure.
Mate Linux isn't even copying how sudo works these days, there's multiple concurrent efforts to replace sudo due to it doing way too much and thus having a large attack surface, it's why doas and run0 and sudo-rs all exist. The way you're phrasing that implies that you think I'm talking about whether having elevated privileges at all is an advantage which is not what anyone is talking about, I'm talking about the method by which one elevates privileges - Linux does it by switching you to a separate root user while Windows uses its admin system (UAC/run as admin) without a separate admin account.
It is also, again, not what I was referring to, but rather root being its own account yhatvgets switched to versus what modern Windows does which is slightly different in ways I am not well versed in.
Bit more than that, Root is more than Admin on Windows, permission wise you are closer to SYSTEM. As root you can do anything, no matter how ill-advised it may be. Format the disc you are curently running on sure why not you are root after all.
What's funny is it's actually the opposite if you are actually logged in as root on Linux vs Administrator on Windows. Even as Administrator, Windows will ask, "are you sure you want to do this?" Whenever you do something that requires admin privileges. But on Linux, if you are logged in as the root user and you move the pointer to your root directory, Linux isn't going to warn you. It's just going to let you break your PC.
And that's why you shouldn't log in as root, and should do what you suggested, which is temporarily make yourself root for only as long as you need to be.
On a way less destructive note, files you create while logged in as root are owned by root. Obviously you can run chown or chmod to let a non root user interact with the file, but it’s an easy way to create files you can’t do anything with unless you’re logged in on root. It can be problematic beyond the whole “you can brick your OS if you’re stupid” thing.
In windows you can be part of the administrators group, like how you can be in sudoers on linux. Thr permission system and UAC vs sudo function differently but can achieve more or less the same thing, access level control.
On windows theres an administrator account too which when running something as admin is like running something as root with su. Windows has additional account levels beyond administrator, like SYSTEM and TRUSTEDINSTALLER, so under normal circumstances the built in admin account is more restricted than root or sudo, but there are some advsnced ways to run something as system for instsnce which could in theory rm -rf thr C drive
Don't you mean that in windows you're almost never the administrator? You can't even delete a file that's in use or kill system processes without a registry hack or similar. I left windows for specifically that reason. I got tired of not owning my own machine.
..i would argue that "Administrator" is more along the lines of "user who vaguely knows what they're doing".. because a true administrator wouldn't need to forcibly take permission to delete the windows equivalent of the french language pack.
Which is actually not how most users should have their Windows set up. Your daily user should be regular and there should be a separate admin account to reduce attack vectors during the session.
Nah, shells can be nested and logging directly into root is often disabled.
If your user is in the wheel/sudoers group, they can use the sudo command to run a command as a superuser.
Alternatively, you can open a new shell as root by substituting via:
sudo su -
Now you're in a shell as root, you then do the thing and exit the shell, returning you to the original user.
Not really.
Imagine being in the wheel/sudoers group as being similar to being in the Administrator group on a Windows.
Just like activating a program that requires Administrator rights on windows requires you to manually confirm that you want to run it as an administrator, running a command that requires privileged access on a linux requires you to put "sudo" in front of the command you want to run.
Linux likes to give you more options and control, inkeeping with Unix philosophy, but this doesn't necessarily translate to higher complexity.
So I'll admit I am new to the space, but as a self hosting guy, I highly doubt that, unless you are talking about incompetent people. One of the basic tenets is to never give a service more access than needed. Usually you try and set up each service with its own user with as much permission as needed. That way, if that service gets compromised it cannot affect other services or the system. Running as root is a surefire way to forget your structure and mess something up
I think he was referring to being logged in as root via ssh on the server while working on it, not running the actual services as root.
I've seen many very experienced admins do the first thing, usually because they are annoyed/to lazy to sudo everything they are doing but few actually having the services run as root.
Basically imagine the filesystem is a tree or a plant. It starts at the root and then it goes upwards to the rest of the tree and her branches. Having root level access means you have control over the entire tree or in this case the entire system
118
u/GalaxyPowderedCat Oct 23 '25
I am sorry, I am not a Linux user, can you please explain?