I'm wondering if someone can explain the rationale behind sudo. Ubuntu uses sudo by default, rather than having normal root access, although you can use root access if you wish. This is supposedly done with security in mind, but I don't see how it makes things more secure. It seems to me that allowing a user to execute commands which require root privileges, without having the root password, is really dangerous. For example, logged in as bnonn I can execute:
$ sudo passwd root
And change the root password. This doesn't seem secure to me!
What am I missing?
Ubuntu's decision is more a social one than a technical one. If you are asked at install time to create two passwords, one for 'root' and one for your user, chances are they will either be the same, or insecure, or forgotten, or you won't see the point of the root password and leave it blank, etc. If you only have one password, you remember it (you use it every day), hopefully you rotate it. You don't get confused about which one to enter if you're asked to enter the password, although this one really only applies to new users. It is also the model that Mac OS X uses, I believe. Only the first user created on an Ubuntu system has sudo access to everything. This suits a single user desktop machine really well, and if it doesn't suit your needs, it's very easy to change. You've already told us how! If you want to set the root password you're allowed to, but sudo is a great idea for giving people administrative access without having to let them know the root password (or in this case, without even having one.) Craig