[thelist] [OT] MS vs *nix WAS:( New Critical Security PatchforWindows)

Jason Handby jason_handby at illustraresearch.com
Fri Feb 13 04:30:03 CST 2004


> One that sticks out in my mind is this:
> 
> On Unix, a user has to run 'su' or 'sudo' to actually run commands as 
> root (administrator). On the *BSD systems, that user has to 
> also be in 
> the wheel group (Richard Stallman has a reason for not 
> implementing the 
> wheel group in GNU su). It's considered poor practice to directly log 
> in as root except when absolutely necessary.
> 
> On Windows 2000, once a user logs in and is in the 
> administrator group, 
> it is as if they logged in as administrator all the time. That user 
> cannot drop administrator privileges when they aren't needed 
> and is not 
> prompted for additional confirmation for actions that require 
> administrator privileges.

That's because the "wheel" group in Unix and the Administrators group in
Windows 2000 are conceptually different things.

Membership of the "wheel" group means that you are allowed to *become*
root/administrator (using "su"). Membership of the "Administrators"
group means that you *are* root/administrator already. It's a way of
"marking" multiple user accounts as having administrator rights.

So in theory the right setup under Windows would be to have two
accounts; one normal user account, and one Administrator account. Log in
as the normal user unless you're installing software, configuring, etc.
in which case you use your Administrator account.

Personally I think the Windows model is much better. In Windows the
administrator is identified by their membership of the Administrators
group. This means you can have several separate user accounts, all with
administrator rights, and yet with separate unique user IDs which means
you can separately audit their activity much more easily.

The other great thing about Windows is that a file or directory can have
different rights assigned to it for many different groups (unlike Unix,
which only allows a file to be owned by one group, meaning that
correctly factoring your groups to give the access you want can be a
real pain).


So I would say that, yes, the Windows model is different -- it took me a
while to get used to it -- but actually I think it has some advantages!



J

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.580 / Virus Database: 367 - Release Date: 06/02/2004
 



More information about the thelist mailing list