We live in a dangerous era. Malware, spyware, RANSOMWARE! So many of us want to know what we can do to keep our computers safe. One of the best ways to protect your computer is to NOT be its administrator.
Admin ex Machina
I know, being a system administrator is sexy. The admin is a privileged account. You can do anything (at least to this computer). Add and delete users. Change settings. The entire machine is yours to command. All you need to do to install any software is just click "Yes." MWAHAHA!
However, this means that all you need to do to install ANY software is just click yes. And if it just takes a click, a script can automate that. So, you don't have to click anything at all. If you are the admin, a program can simply install itself and make any changes to your computer that it needs to. You don't need to do anything. You don't even need to know it's happening. Any software.
Even malware and spyware and ransomware—oh my!
With Limited Power Comes Limited Responsibility
Now contrast that situation with a standard user. The standard user goes to install some software, and they are met with "To continue, enter an admin user name and password." If an admin does not actively enter their credentials, this software is not getting installed.
The same is true for malware. Professor Messer explains, "If the user's permissions are limited, then the malware will also be limited."
This safeguard is not to say that those with admin credentials can't be tricked into installing malware. But this trickery will have to be out in the open instead of hidden away, running in the background.
I Am Root
So, in Windows, we have those two account types: standard and administrator. But in Linux, there are three. The first and the last of Linux users sound much like Windows accounts. There are regular users with limited privileges, and then there's the ultimate administrator account. The default name of this account is "root." These are opposite ends of the spectrum. While a regular user has very little lasting influence over a computer, the root user can seemingly do anything. Install any software, change the kernel of the operating system. The root user is a god in the machine.
… and this is why the first thing a hacker or malware does when penetrating a Linux machine is to try and become root. As such, best practice in Linux is to disable the root account. Change the name, obfuscate the password, etc. At this point, as a Windows user, you are wondering who's the admin on Linux if root is disabled?
Talent on Loan from Root: Superuser to the Rescue
There is a special group in Linux called superuser. These are users that have a very cool superpower. By adding the command "sudo" to what they enter, they wield the power of root. It even seems like casting a magic spell as sudo stands for "superuser do" as if invoking divine power.
Adding a four-letter work doesn't seem like much. But only users in the superuser group can use this word. Each time they want to use this power, they have to add sudo to their command. And because of this, Linux is more resistant to hackers and malware. For this reason, when a user first signs into Linux, they are super users.
This sudo group is also true for the default accounts, from pi on Raspberry Pi to kali on Kali Linux. And because these default accounts are super users, they are very dangerous. If hackers or malware gets access to a system with one of these defaults, they can do almost anything. As such, one of the first thing Linux users should do is delete this user from the sudo group:
|
Better yet, just type "sudo deluser pi" and delete this user from the system. Having default accounts available is a vulnerability in itself. Smart hackers and malware can access these accounts and can perform a privilege escalation to perform root functions.
Super Users Don't Do Windows, so Now What?
What about us in the Windows world? What can we do? Well, we are either a standard user or an administrator. When we first set up our new computer, the default setting is to make that initial user the admin. This default is necessary. And it's good—as long as we remember to set up that user as thee admin.
Thereafter, we have to use this account to create a separate standard user account for us.
By each of us using a standard account, we can go about our business normally. We type documents, calculate with spreadsheets, present presentations, etc. But what if we happen to need to install some software or perform some other administrative tasks? Then we enter our elevated credentials for that specific activity.
The Policy of Least Privilege
Alright, I know how that sounds coming from someone who's a Managed Service Provider. I have access to admin credentials for business all over. Who am I to tell anyone not to be the admin on their own computer?
I'm someone who is a standard user on my work computer and on my personal computer.
And this is the best practice in the IT industry.
In IT, we know the power—and responsibility—of the administrator account. Administrators are responsible for what happens on the systems that we oversee. As such, why would we want that responsibility every time we want to buy something off of Amazon or watch a video on YouTube.
So, unless you are actively administrating that computer at this moment, be like us and use a user account.
Evil Lurks
Just because all of us are no longer using the admin account does not make us immune from the dangers out there. Not all software requires administrative permission. As such, any user can inadvertently install certain malware.
And remember the privilege escalations mentioned earlier? Hackers and malware who have gotten a foothold on our Windows systems can perform similar exploitations to perform administrative functions.
As such, we still need to be smart about how we use our devices. Similar to teaching our children not to take candy from strangers, we need to remember not to click links from strangers. Or download attachments from them. Or give strangers your personal information. Etc.
Even with the proper training, accidents happen. But there's a massive difference between a standard user making a mistake and an administrator making a mistake. Don't be an Admin.