Hacker News Reader

Comment by jiggy2011 | Hacker News Reader

jiggy2011

Sudo has always felt like a bit of a blunt instrument to me.

For example having to type the root password every time I want to run a vaguely administrative program or install something etc gets old fast.

Not to mention the number of times I've made a bunch of edits to something like a conf file in nano and then gone to save and got "permission denied" where the only solution seems to be to exit nano and run it again (and do the edits again) with sudo. Surely it should be able to prompt me for the password at save time?

View on HN

Sudo has authentication timeouts built in, so you don't have to type in your password (your password, not root's) every time you want to run an administrative program. Also, the fact that you have to sudo is one of the reasons why Unix is more secure than the Windows "administrator by default" approach.

As for your last point, you're complaining about nano. It would be perfectly possible for an editor to sudo when writing to disk.

This is something that seems to be the case on vi and emacs too, I have never seen a unix program which prompts me for sudo password at the moment that it needs to do a privileged operation rather than requiring running via sudo.

I have, but it was a patched version.

I think there's a sense, which I generally agree with, that random applications asking for your password is something we don't want users to get used to.

When I vi a read-only file:

     "/etc/mail/aliases" [Read only] 36 lines, 1023 characters

Its simply a matter of remaining keen when doing admin tasks. Sure I have to close/re-open with sudo but its prompting me up front that I won't be able to save it.

You can do something like this instead (IIRC):

    :w !sudo tee % > /dev/null

It's a bit of a hack, but it works.

> Sure I have to close/re-open with sudo but its prompting me up front that I won't be able to save it.

No, you don't, and yes, you will:

  :w !sudo tee %

On emacs, you can C-x C-f /sudo://etc/hosts and it'll do what you think that means, including prompting for your password only once in $TIMEOUT. It's the same base mechanism that lets you C-x C-f /user@host:path for remote editing through ssh.

Windows hasn't been "administrator by default" since Vista.

It's still administrator by default, they just prompt you to click ok on every administrative action, something users still do blindly.

And Ubuntu users don't blindly enter their passwords at gksudo prompts?

Huge difference between hitting OK and typing the admin password.

Really? Both are pretty instinctive to me, I do them with little thought. I even switch capslock on and off mid-password without thinking about it to type a capitalised portion.

Yes really. Anyone can hit ok, but not anyone knows the admin password. Someone can't walk up to your machine while you're away and install software in Linux, they can in windows. Hitting Ok is not sufficient. The point of sudo is to verify your identity, an ok prompt does not do that.

No, it's not administrator by default. The first user created is an administrator, but that user normally runs in a standard user security context. The prompt provides a temporary elevation to administrator level by use of an administrative security token associated with the account. The prompt also runs in a separate desktop to prevent malicious code from interfering with it.

If you try creating a new user through the control panel, you'll notice that the default selection is to create a standard user.

> The prompt provides a temporary elevation to administrator level by use of an administrative security token associated with the account.

Rather what I said. A borked version of sudo.

About your file edits:

-Save your modified file to a temp file and work it out with cp or mv after.

-Use Vim, and the infamous ":w !sudo tee %".

> Not to mention the number of times I've made a bunch of edits to something like a conf file in nano and then gone to save and got "permission denied" where the only solution seems to be to exit nano and run it again (and do the edits again) with sudo.

Nano asks you for the file name/location when you save, just save the file somewhere you have write access to then move it with sudo afterwards. No need to retype your edits.

> I've made (edited) something (...) in nano and then gone to save and got "permission denied"

sudoedit handles this exact case. Try it, it's very convenient. (Of course, you have to set at least one of SUDO_EDITOR, VISUAL or EDITOR correctly.)

You also want to know about visudo, which will save you some oh-shit-I-locked-myself-out moments.

If I have to use sudo, I always:

  sudo -i
  # do root work
  exit # or ^D

If you find you can't save a file because of permissions, just suspend nano with ctrl+z, fix the permission, resume suspended job with fg, save file. No need to lose your edits or hassle with temp files.

Reply on news.ycombinator.com