Linus Swats Security on SUSE
Linus is more than a bit outspoken and is not shy to use strong language. He is in the news lately because SUSE asks for the root password for:
- setting up wireless,
- setting up a new printer, and
- setting date/time, timezone…
He has a point. There are systems where these settings are crucial for security but a kid’s notebook at school is proabably not one of them. In a business you may well not want 1000 nude photos to be printed in the boss’ office ( I have seen that. A student caught the principal’s password…) but in a school with the local system admin protecting what he wants to protect, not so much.
Fortunately GNU/Linux is flexible and the guy who controls the “root” account can set it up so that a mortal user can do these things. Even if the root user doesn’t want to bother with security settings for some reason, root can set up a cron job to copy settings from a user’s directory to the system. One way or another it can be done.
The machine I am using is not wireless but I can deal with the other two:
- printer settings – CUPS (Common UNIX Printing System) has settings that allow root to give any or all mortal users the ability to control printing completely. On my Debian GNU/Linux system there is a group for that, “lpadmin”.
usermod -a -G lpadmin pogsondoes the trick and pogson is in the group as soon as he logs in and can tweak CUPS/printer settings and add printers. Of course there is a risk of messing it up so a system administrator should backup the settings before doing this so they can be put back if necessary. An ordinary user can use a CUPS client application or the web interface on http://localhost:631 to control CUPS. The web interface needs to be opened up to allow both access from localhost and local clients. You can also give a particular user control over settings of a particular printer and allow them to change settings for that printer only. So, define a printer, “joe” and allow the mobile user to define it to be whatever he needs wherever he needs it. - timezone – There is no need to have a travelling normal user change the timezone settings of a PC. They can simply use a client application with a variable set as needed:
dateOne can easily tweak these things in Debian GNU/Linux. My current desktop uses an XFCE4 date/time plug-in which does have a timezone setting but I could replace it with a cron job to display the string above every minute as needed as a normal user. On my system, I can also redefine the “date” command in .bashrc as
Wed Feb 29 15:55:51 CST 2012
pogson@beast:~$ TZ='America/Vancouver' date
Wed Feb 29 13:56:31 PST 2012
alias date="TZ='America/Toronto' date"
So, Linus may be right that SUSE is too inflexible for his daughter but Debian GNU/Linux is not. The system administrator can easily set it up so that a normal user can do what he needs.





