Discussion on:

No more Ubuntu on Dell in the United Kingdom

So what really happened? Is it a publicity stunt, or just simply a reflection of the lack of demand for pre-installed Linux at large.

that the brits are smart enough to realise that with no root password ubuntu is not secure

for a while Jaqui,and only me.My partner has Vista,on her laptop.Dont ask,it was pre-installed when she bought it.
As she does not use Ubuntu,there is only me to consider....er...and my seven year old son,family members ,visitors,burglars....all who should not touch!!
But I see your point.However,if you do want that extra safety in Ubuntu:

http://www.ubuntux.org/how-to-change-the-root-password-in-ubuntu

but I have definite issues with vendors who cripple security by default in order to make it easier to use.

So I won't touch Ubuntu, if I want that sort of attitude, I mightb as well stick with windows.

You have a very strange view of security of you think that Ubuntu is crippled in this regard. Either kind of account is protected by a password - so ANY system depends on the strength of that password. If I have the root password on a system, there is nothing I can't do - if I don't, there isn't much I *CAN* do. Same with Ubuntu.

The advantage (security-wise) of the Ubuntu method is that you CAN'T (by default) operate as root, and thus unintentionally expose the system to problems.....

It is very easy to implement more layers if you want them.

Default set up in Ubuntu is if you break my password, you have su is it not?

Please correct me if I'm wrong.

When Microsoft gives you FrontPage in IIS without protection, in the year 2000 or so, people criticized that Microsoft wasn't secure. Linux always said they were more secure, now they do things the way that Microsoft did in the past, so Linux didn't learned from what they said, and made the same old mistakes.

Why should I change it, or why not at installation asks for a password? User-friendly software should always inform to the final user what it might happen if you don't give a secure password to the administrator users, and you can?t expect that final users (none technical) go to research for technical details and learn about ?How to enter to the shell?, ?What sudo is? etc, if the installer creates a password for the ?users?, why not creating a password for the root user? It?s the same stuff.

Suse, Redhat, Debian, Slackware, Gentoo and (what else have I tested in the last year or two?) others all ask the installer to define the root password, then define a non-root user.

Ubuntu doesn't ask you to set the root password, but it is not left blank. You cannot log in as root with a blank password. But once logged in as yourself, you only need your own password to perform any root-level operation.

I believe PCLinuxOS might leave the root password blank. I used it only briefly to test, and remember logging in without a password. I can't remember if it was before, during or after the installation.

"User-friendly software should always inform to the final user what it might happen if you don't give a secure password to the administrator users"

As regards OS installers, they do. Ubuntu choose to skip any remarks about the root password during install.

"and you can?t expect that final users (none technical) go to research for technical details and learn about"

Most developers these days don't have that expectation. Most programs I install are done through a software manager (Yast, Synaptic, etc.), which has a graphic interface. If an end user wants to run a CLI-based program, he or she will need to do the research to learn how, or find a GUI alternative.

They also allow runlevel 5 root login.
[ which is never recommended ]
The *buntu distros are the only ones I have seen that disable the root password.

Where did you get this ubuntu? kmart blue light special? Ubuntu always asks you to assign a password. What do you mean?

Of course one can set a (new) root pass without knowing the previous one. Just exit out of lilo or grub graphic mode and boot the image adding "single" to the parameters.

You come up with a kernel level shell as root. a quick "passwd" command and reboot, voila. New (and hopefully more secure) root pass word.

And the beauty: anyone who doesn't know how to do this, shouldn't do this!

For my tastes, I'd far prefer Mandriva 2008 over any other, I can't say enough good about this distro.

The liveCD is the standard on my work issued notebook when not at work and it runs great.

Have you installed from the DVD Free and had any issues? I keep getting missing packages until I can get past the first boot and add network repositories then urpmi them. (gnome mandriva theme pacakge, kde mandriva theme package and a package of icons with my minimal install selection)

Hopefully the next build of the DVD ISO will correct the issue. I'm not complaining since it's a 2008 version available Sept (or Oct) of 2007. I'm just curious to understand if it's just me getting a bad DVD ISO or if other's have had the issue.

I can't wait too cut my servers and workstation over to 2008 but servers won't be changed over until updates for 2007 stop coming through. I probably won't be able to hold off on the workstation once I see a clean install from the DVD Free ISO. That will also give the 2008 repositories a bit more time to bulk up.

Ubuntu is not Linux.. it's one seporate OS and user apps wrapped around a Linux kernel. Each distribution is different with different goals so I wouldn't mistake Ubuntu for being representative of all other OS that happen to be based on the Linux kernel. There was also a lot of discussion over the sudo setup when Ubuntu was first released so it's not like "Linux didn't learn from what they said". Actually, reducing default security is the very reason many techies stick with there own prefered distrobution rather than switch to Ubuntu or they aproach it like Windows and do the hardening themselves.

I just wanted to point that out before this degrades into an "Ubuntu reduced security so all Linux based OS must have reduced security."

I think most people agree with your second point; security by default. An admin password should be setup during installation just like the user account and password is setup. Cononical, as is there right, chose to build there distribution this way so the community responded by posting howto information on correcting that security flaw.

I'm sure Ubuntu's developers or the people distributing this version for Dell probably are doing the same thing.

The only problem is, I would think Joe Sixpack would get mad having to put a password in every time he installs something.

Maybe I'm wrong; the average user may only care about email and surfing. But just to gain the full web experience you have to constantly install some control to make the fancy shmancy web site work. I assume most would use Firefox; would they be putting in a password at every turn?

Granted this pain would subside and slack off for a time as the user gained functionality.

most apps installed for multimedia content have a plugin for any browser.
[ actually, it's a separate tool that turns any app into a plugin ]
So it's only for flash or realmedia files they would be prompterd for software install.
[ and Firefox can install to itself, like plugins and updates no password required ]

as there is still a large body of consumers that probably don't care about security issues, or hope the obscurity concept will carry them along.

If Ubuntu is at least as stable as Windows ME I would think there would be a lot of happy campers.

I've only had one customer that didn't like alternatives; and that was Lindows. His mind may have been poisoned by using Windows too many years, or perhaps it wasn't as user friendly as even Linspire is now.

I've never had the opportunity to get feed back from him yet.

As far as Windows XP I have to loggon as administrator to install quite a few of the IE 7 and Firefox extensions; but then I have policy set that way on purpose.

I tought unbuntu was only available at time of pc purchase in the us anyway. Maybe got the wrong end of the pole but would not buy a Dell computer, so no loss there.

as most software is auto installed during the install, and then just works. Others are installed during regular updated through Adept. I find it no hassle.

nt

What it does, is gets you to enter a password when you install it. It uses that password for your root access and your main user account. When you log on, it logs you in as the user, and when you want to do something as root, it asks for your password again. If you're one of those people who wants to have it do an auto initial log in, it can be readily set to do that, but you always still need your root password to be re-entered when you ask to do something that requires root access.

???

I don't even know what are we ranting about Ubuntu security issues. It always asks for password. Log-in, update, even when I tried to move the RealPlayer icon from the desktop to other directory. If one needs to be real secure, maybe one should try to set up a password at BIOS level. Then you can always (I haven't tried it yet) reset the jumper in the machine within if you forget the "root" level password. Using password just to log in every time you turn on the machine can be a nuisance to say the least especially you have got nothing in it that is that important.

similar distro and I need to know about the security. It helps to be able to tell customers they can secure their system as well or better than Windows if that is important to them..

I like the forced loggon at boot up because I have had crackers blow past my PXE disable to start my machine when I am not there. They did this thru a totaly stealthed Netgear firewall so I must have caught a bot bug somehow.

They got as far as enabling the unused local machine Administrator account to auto-logon so they could do their dirty work when I wasn't watching. Needless to say I wiped the drive and did a clean reinstall and trashed all previous passwords after that!

I have learned to be eternally paranoid since!

.
Ubuntu works like Mac OS X and Windows Vista with respect to this.

The root account does not have a password in the default Ubuntu install and it cannot be used. The password you enter during install only applies to the "administrator user" account you create. That account can use sudo to elevate privilege to root for a single command. And, it can cause a program "run as root" in the GUI (which uses sudo also). But, it cannot su to root because root is "disabled" (no password).

For the full story:

Don't fear the Ubuntu
http://techrepublic.com.com/5208-6230-0.html?forumID=102&threadID=243773&messageID=2356888

I think that guy who made this statement about unbuntu not mentioning password was testing the koolaid

I know you two have covered this in countless other discussions, but I'm going to waste your time and ask again anyway.

What is it about Ubuntu that makes it less secure that other distributions? If possible, please phrase your answer in terms a Windows user / Linux neophyte can understand. Feel free to stick with one syllable words.

on Ubuntu security.
The debate stems from the rampant use Ubuntu makes of the sudo command, it prompts you with a "run as administrator" option when access is needed, but it wants the current users password, not the root/administrator password. Ubuntu gives the first user created, during install, nearly complete root powers (they have to sudo to gain access). A single compromised password, for a normal daily user can compromise the entire machine. Subsequent users do not have full sudo privileges. (This is in Ubuntu 6.06 ie the stable version I will have to double check this in 7.04 and 7.10) Sudo can be restricted, and controlled, so that one user may only have sudo rights to mount hard drives, or update software, or just update the apt-cache. But managing sudo is an irritation, as once you limit the abilities, you have to explicitly state all commands you will allow. Sudo was originally intended for allowing limited access to one or two scripts/services that needed more then standard user privileges.
http://www.softpanorama.org/Access_control/sudo.shtml
Has a good over view of pros and cons.
Debian, the Ubuntu base, asks you for the root (administrator)password if you need access to root powers, this is the basic Linux method. The two password system used by 99.9% of *.nix systems is generally considered safer (and I agree with this mode of thought, see the cons in the listed article for sudo). And the su (run as)command exists in all Linux systems to allow you to gain root access if needed (using the root password).
MY problem with the Ubuntu security lies in its complete lack of a firewall and several unwanted services running by default. The firewall can be taken care of by straight command line (ACK! not for me yet, I am working on it though) or any of several gui tools to create the rule base for ipchains. The unwanted services (example a bittorrent service is enabled by default) can be turned off with the Services tab in administration, but this list is incomplete, thus requiring another option. The ncurses rcconf or the GUI tool BUM(boot up manager) are both in the synaptic gui or the apt-cache.
To Recap:
1) A single password allows the initial (most likely to be used) account administrator privileges on the machine through the use of their password.
2) No firewall at all by default.
3) Several unwanted and exploitable services are enabled by default.

If you are network savy, but not so much linux savy Bastille is a good package to help lock down a linux box. It is in the apt network for all Debian off-shoots, Gentoo has it, and I imagine all other major distros do as well.

All this being said, Ubuntu is still safer after a clean install then XP SP2. but its only half as secure as say a default Red Hat or Suse install. But then if you are really paranoid about security you would be running a BSD anyway...

Ubuntu is part of the security vs usability trade off in security, attempting to let people get their feet wet with Linux. ubuntu has vered to the side of improved usability

I remember the days when Dell was shipped with RH 6.1 preistalled. That was good and stable enough, and had very good support from DELL in commercial cooperation with RedHat. RH and only RH could create regular updates for his Linux packages and releases, so customers were quite happy with this policy.

With Ubuntu user now has an unlimited access to the untrusted (including World) repositories. Even worse that there exist full Ubunturelease updates (Gutsy and previuos) that brakes systems hard almosts at every second installation. This often happens if user had updated or installed some untrusted packages from worldwide repositories.

Ubuntu (like all Debian) is an untrusted Linux distribution source. No one on the Planet could take any responsibility on careful tests and/or security, as well as support and maintenance in such conditions.

I think, Dell just understood that it would be incapable to provide any good support or help on Ubuntu.

Hopefully legal too.

They sure like to sell support for Windows.

I imagine it would assuredly still compare price wise to the Windows box. Even if it didn't it would get people away from all the Windows problems so they could concentrate on just enjoying computing for once.

That is worth a lot - No more calling me and getting charged for figuring out Windows annoyances, no more bloat, no more bloated anti-virus/maleware suites, no more slow page loading because of all previous mentioned causes; NO MORE FLIPPING WGA ISSUES!!

Oh Yeah! I think is is well worth it!

I think this is exactly where Dell comes unstuck in this venture because their website clearly states: NO UBUNTU SUPPORT.

Good grief even Walmart was smart enough to sell Lindows units with a year of support.

I don't know about the new one Wally World is offering now.

I still think these people WANT the project to fail just to make Microsoft look good.

I think Dell found out that Unbuntu was a support nightmare $$ wise and that warranty returns from average joe user was running way to high, simply because average joe user couldn't figure out how to run Unbuntu.

That and the call centers in India didn't have the paper scripts the operators could read to average joe user to fix the problem.

been created by Dell - the system should be installed and set up for proper working before it leaves their facility, the same way they do with the Windows machines. I would expect some driver problems as Dell has a reputation for using obscure but very cheap hardware at time - thus making proper drivers a major issue. But they should be ensuring they have working drivers for their systems and have them installed. After that, other software etc is very simple with Ubuntu.

Aren't there projects out their that already sell support for various distros like Ubuntu? I'm pretty sure there are for Mandriva(Linspire); I'm just not up to snuff on the other distros.

If so, Dell could have at least pointed their customers toward that direction; if they didn't have such a pigheaded proprietary attitude that is.

That's what I remember hearing anyhow but I didn't have reason to dig through Dell or Cononical's website being that I'm not in the market for a new machine or currently being asked for that type of recommendation.

If I'd heard correctly though, Dell was selling the hardware with Ubuntu installed then forwarding customers to Cononical's call centres for support.

and they'll help with anything that's a standard Ubuntu matter - the only issues likely to be unusual are any Dell special hardware that requires special drivers. If Dell hand these over to be included in the standard Ubuntu repositories, there's absolutely no support issues at all. However, what's more likely, for Dell to keep those drivers as proprietary and not hand them over - then, you could see some support issues related tot he drivers and interactions with updates etc. In much the same way they have issues with updates and drivers in Windows.

Windows drivers let alone support Ubuntu. I'd bet a guy would have better luck looking at who ever made the original equipment.

I see a lot of Linux support listed at OEM hardware sites lately.

is that many of the manufacturers have given up on making the equipment out of the box compatible with Windows.

Many years ago, the industry established a group of standard instruction sets for all hardware. This is what made 'plug and play' possible. For a short period, everyone used them. Then Microsoft started writing their Windows software using a different set of instructions, and you needed a driver for each piece of hardware to work with Windows, unless a driver was already in the Windows driver sets.

Many manufacturers decided to make their equipment more compatible with Windows, and started designing their new equipment to use the instruction set of the current Windows operating system. That's why some systems are just plug and use for Win 2000/XP but need special drivers for Win 98 etc. This worked well for the peripheral manufacturers for a short while. Then, in one of the XP service packs, MS changed part of the hardware instruction set - which is why some equipment needed new drivers after that SP was installed. The new XP drivers included both instruction sets. Since MS don't give out their instructions sets freely, the hardware manufacturers had to pay for them, twice; this upset a few of them.

Since that problem, some have gone back to using the generic instruction set, and writing complete driver sets for Windows. Because of this, any operating system using the generic instruction set will work with that hardware without the need for a special driver. Basic Linux, and most of the distributions, uses the generic instruction set. This makes it a lot easier to use hardware out of the box now.

If all the hardware manufacturers went to using generic instruction sets, and put the responsibility of writing Windows compatible drivers on MS, we'd see a lot of people move away from Windows. As it is, many people don't upgrade their Windows OS, as the new stuff doesn't have compatible drivers for their peripherals - especially their specialised peripherals. As it is, MS gets other people to do a lot of their work for them in this area, because MS uses non standard code.

"Continue anyway" a lot when I install drivers and other software.

Microsoft seems to go out of their way to generated animosity between them and their software customers too.

Everysince WGA I have been planning the switch.

distributions after over 15 years of Microsoft DOS and Windows - I wanted an operating system that did NOT force me to rebuild the system every five or six weeks. No broadband access, so I turned off Auto updates and was selective about updates. Get four or five weeks behind in your updates, or not have them all, and WGA declares your system a pirate. Crash of system, another call to MS for another reactivation code, but it requires a rebuild to work, aarrggh. Finally got fed up and looked at various Linux distros.

Liked SimplyMEPIS, but had some issues with the 64 bit version, so now use Kubuntu - and no issues at all.

Set me on the road to Linux as well.

Good to hear about Kubuntu 64bit as that is the path I am on also. I am a newbie but I hear good things about the KDE kernel.

Kubuntu in 7.04 and 7.10 are both very easy to use - they have a very Windowish feel to them, this helps with us long term Windows addicts - in fact, Kubuntu out of the box, looks more like the old familiar Windows 98, than Vista or XP do when first out of the box.

I have an Intel 64 bit system, and the 7.04 Kubuntu work great with a basic auto install - all my fancy hardware works with out of the box drivers etc - no extra software to load - except the 64 bit version of WINE, for some older applications I use (Forte Agent is the main one).

It takes a minimal install and adds in all the packages then updates all the configuration files with my server specific info (hostname, mail deamon settings) and finally builds a couple of tarballs for needed programs not available as RPM packages (ISPConfig and some others).

It's pretty cool to see it in action and has cut my server rebuild time down from a few hours of hunting and picking for packages to an hour of standardized selections with only a few places that require human interaction. I could probably remove all human interaction within the script using Expect.

(The final build will have restore images and backups but I needed a script to automate the initial build and consecutive rebuilds of the development rig.)

Now, it's currently a glorified .bat file until I get some grep and replace coding into it rather than "echo blah >> file" or "cp base.file /path/file" but wow is scripting a whole new thing under *nix. I used to write some crazy .bat for dos and have done some complicated .bat and .cmd for winNT but nothing like scripting for Bash.

I hear Perl makes scripting a whole new level above that again.

Note, I know of .vbs but I've always done my VB VC++ coding in studio or used a nice small third party macro/scripter I picked up (an old copy of Hotkey macro recorder).

Now, at least I know what we are dealing with and what the rantings are all about.

Just to correct you here, SU is *NOT* "Run as root" that's effectively what SUDO is for, SU stands for "Switch user" when it's run on its own it switches to the root account, but if you specify a username it will switch to that user (i.e. "su bob" will switch to the user bob). By contrast, SUDO will run the command as root and then return you to the original state (i.e. on the command line it'll run the command as root and then put you back to your normal user).

but he did ask for "simple terms" that a "windows user" would understand. As windows does not really have an equivalent to sudo, I linked su to "run as"

Fair enough, but SU isn't run as, sudo is the closest thing to run as, as it means "Run this command as root"... so really the windows equivalent to sudo *is* run as, just without the option to run it as anything but Admin.

When user can run sudo bash and he gets root shell, it's turns to be a full equivalent of su.

Sudo in any system must be configured to run only some of commands, and not all.

sudo /bin/su - give me when sudo is not properly configure to prevent this kind of behavior?