Safely Use Root Commands

From Whonix



What is the point on a typical single user Linux desktop computer of separating privileged administrator account (called root account) and limited user accounts (such as for example user user)?

It is assumed that most desktop computer users are single user computers. I.e. computers being used by only one person. Rather it is assumed that most users are only using a single login user account which will be refereed to as user user.

Quote xkcd authorization [archive]:

If someone steals my laptop while I'm logged in, they can read my email, take my money, and impersonate me to my friends, but at least they can't install drivers without my permission.

Quote [archive] user discussion:

Most people will consider their home directory as more important than root dirs

Once a malicious program has access to my home folder, I dont care if it also has access to the admin content

This is true for most users using single user computers, using only one user account and no virtual machines. As a counter messure this is why this documentation recommends recommends compartmentalization. I.e. running different activities in different virtual machines or even on different hardware.

The rationale of prevention of root compromise has the following goals: [1]

  • Protect the virtualizer: this is to make it less likely that malware running inside the virtual machine can break out to the host operating system. [2] (Applies only when using virtual machines.)
  • Protect the host operating system: Malware breaking out of the virtualizer is a lot harder without root access. (Applies only when using virtual machines.)
  • Protect the hardware: A compromised host operating system might result in malware infecting the hardware, i.e. to avoid a persistent hardware backdoor (such as in BIOS or other firmware) surviving even re-installation of the host operating system. In many cases, root access is required before hardware can be attacked. [3]
  • Protect against compromised non-root users: it is harder for potentially compromised other, non-root users (such as www-data) to access user user or other parts of the system.
  • Sandboxing: Sandboxing applications can prevent applications getting exploited by attackers [4] or limit the severity of the exploit since if sandboxing is successfully, malware will be trapped inside the sandbox. Sandboxing is a lot harder, less efficient or even impossible when applications are running as root. See also AppArmor, apparmor-profile-everything and sandbox-app-launcher.

Kicksecure ™ implements various security hardening to Enforce Strong Linux User Account Isolation.

Once proposal Multiple Boot Modes for Better Security (an Implementation of Untrusted Root) has been implemented there will be a strong guidance for users to better separate their limited (everyday use) account (user) and administrative account (admin). This would result in a robust Prevention of Malware Sniffing the Root Password.

Default Passwords[edit]

Whonix / Kicksecure default admin password is: changeme default username: user
default password: changeme

The default root account is locked (or should be locked). [5] This is a purposeful security feature -- see below for further details.

It is recommended to change passwords.

General Security Advice[edit]

Commands that require root permissions should be run individually using sudo. In all cases:

  • Do not login as root.
  • Do not run sudo su.

Inappropriate Use of Root Rights[edit]

Do not think of root as a shortcut to fix issues.

Ambox warning pn.svg.png It is very much discouraged to establish the following behavior:
application problem → "try sudo / root".

Only use sudo / lxsudo / root if there is a strong rationale for doing so. Otherwise...

Inappropriate Use of Root Rights:

Graphical Applications with Root Rights[edit]

It is discouraged to run graphical user interface (GUI) [archive] applications with sudo application:

  • Never login as root as explained above.
  • This includes, never use sudo su and then start GUI applications.

Doing so would be an Inappropriate Use of Root Rights. That would fail and is a limitation inherited from Debian. If this action is attempted, error messages like those below will appear. [7]

No protocol specified
cannot connect to X server :0

As an XFCE user (Non-Qubes-Whonix default) use lxsudo instead. For example, to launch the keyboard GUI safely, run.

Open file /etc/default/keyboard in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/default/keyboard

Root Account[edit]

Enable Root Account[edit]

For security reasons the root account is locked and expired by default in Whonix ™ and above. For most users there should be no need to use the root account. If it must be enabled for some reason, run the following commands.

(Qubes-Whonix ™: Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs)

If you can use sudo, you can skip the following box.

If you cannot use sudo:

Unexpire the root account.

sudo chage --expiredate -1 root

Set a root password.

sudo passwd

Disable Root Account[edit]

Earlier versions of Whonix ™ (version numbers lower than come with the root account enabled by default. Most users should disable it by running the following commands.

(Qubes-Whonix ™: Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs).

Lock the account.

sudo passwd --lock root


In the future, use sudo instead when it is necessary.

Unlock User Account: Excessive Wrong Password Entry Attempts[edit]

The following steps can be used in case the user entered the wrong password too many times which resulted in the user account being automatically locked.

1. Launch a root terminal.

2. Run the following command.

sudo pam_tally2 -u user -r --quiet

Console Unlock[edit]

1. Launch a root terminal.

2. Run the following command. Replace user with the linux user account name which should be allowed to login on the console.

sudo addgroup user console

Advanced Users[edit]

Prevent Malware from Sniffing the Root Password[edit]

Any graphical application can see what is typed in another graphical application, for any user. [9] [10] Therefore it is safer to create a special, new user account that is less likely to have been compromised, since this reduces the chances of malware sniffing the password to gain root access.

This process is currently for advanced users only since it is quite cumbersome, i.e. has bad usability. The usability of this will be improved once proposal Multiple Boot Modes for Better Security (an Implementation of Untrusted Root) has been implemented.

To more securely perform administrative tasks that require root access:

  1. Prerequisite knowledge: how to switch to a different virtual console, usage of the SysRq key key and login spoofing.
  2. These instructions are ideally applied after installing the host / VM when it is still considered free of malware.
  3. Create a new user account admin.
  4. Add it to the group sudo.
  5. Login as user admin.
  6. Remove user user from group sudo.
  7. Only then perform administrative tasks according to the instructions below.

This setup only needs to be completed once.

(Qubes-Whonix ™: Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs)

1. Create a new user account admin.

sudo adduser admin

2. Add user admin to group sudo.

sudo addgroup admin sudo

Perform the following steps securely using sudo. Use one of the methods below.

Non-GUI Environment Method[edit]

  • Advantage: can keep current user session(s) and/or graphical session (X Window System) running.
  • Disadvantage: cannot use graphical session during administrative tasks. [11]

1. Make sure keyboard gets disconnected from X Window System to defeat login spoofing. (unraw) [12]

SysRq + w

(Press Alt + SysRq + w)

2. Switch to another virtual console.

(Press Alt + Crtl + F2) [13]

3. Press Secure Access Key also to defeat login spoofing.

SysRq + k

(Press Alt + SysRq + k)

4. Login as user admin from that non-graphical environment (virtual console). [14]

5. Perform any necessary administrative tasks.

6. Remove user user from group sudo.

Note: This only needs to be performed once.

sudo delgroup user sudo

7. Logout user admin.


8. Switch back to previous virtual console.

X Window System runs in:

  • most Linux distributions: virtual console 7 (Press Alt + Crtl + F7)
  • Qubes: virtual console 1 (Press Alt + Crtl + F1)

9. Re-login if needed and continue usual work as user user.

Logout Method[edit]

  • Advantage: can use graphical session (X Window System) during administrative tasks using privileged user admin.
  • Disadvantage: cannot keep graphical session of unprivileged user user running. In other words, simplified, all applications run under user user will be terminated. [15]

1. Terminate all running applications in current graphical (X) session.

2. Log out.

start menu -> log out

3. Make sure keyboard gets disconnected from X Window System to defeat login spoofing. (unraw) [12]

SysRq + w

(Press Alt + SysRq + w)

4. Press Secure Access Key also to defeat login spoofing.

SysRq + k

(Press Alt + SysRq + k)

5. Login as user admin.

6. Perform any necessary administrative tasks.

7. Remove user user from group sudo.

Note: This step only needs to be performed once.

sudo delgroup user sudo

8. Logout user admin.

9. Re-login as user user.

10. Continue usual work as user user.

Substitute User (su) Command[edit]

The majority of users do not need to utilize the su command. [16].

In Kicksecure ™ (and Whonix ™), by default:

To permit the su command from user user, complete the following steps.

(Qubes-Whonix ™: perform these steps in Whonix-Gateway ™ and Whonix-Workstation ™ TemplateVMs.)

1. Enable the root account.
2. Add user user to group root.

sudo adduser user root

3. Re-enable SUID.

Set suid. Note: It is okay if the second command fails.

sudo /usr/lib/security-misc/permission-hardening-undo /bin/su
sudo /usr/lib/security-misc/permission-hardening-undo /usr/bin/su


4. Add SUID whitelisting.

sudo mkdir -p /etc/permission-hardening.d

Open file /etc/permission-hardening.d/20_user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/permission-hardening.d/20_user.conf


/bin/su exactwhitelist
/usr/bin/su exactwhitelist

5. Save.

6. Done.

Steps to permit su command from user user are complete.

Root Login[edit]

Root login within a virtual console will be disabled by default after upgrades. [19] [20]

To enable login from a virtual console, first apply the Enable Root Account instructions further above, then complete the steps below.

1. To allow root login, /etc/securetty must be configured. [21]

Open file $(realpath /etc/securetty) in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit $(realpath /etc/securetty)

2. Add the following content.

Note: Add one or more tty depending on your circumstances; see file /etc/



3. Save the file.

Recovery Mode[edit]

Root login is possible using recovery mode. [22]

When the root account is disabled, passwordless root login using recovery mode is possible; see below for the security impact.

Qubes Root Console[edit]

1. Open a dom0 terminal.

Qubes App Launcher (blue/grey "Q")System ToolsXfce Terminal

2. Run the following command.

Replace vm-name with the name of the actual VM where you want to open a root console.

qvm-run -u root vm-name xfce4-terminal

Passwordless Recovery Mode Security Discussion[edit]

This is only relevant on the host and not inside virtual machines.

Passwordless recovery mode is allowed because a locked root password would break the rescue and emergency shell. Therefore the security-misc [archive] package enables a passwordless rescue and emergency shell. This is the same solution that Debian will likely adapt for Debian installer. [23]

With passwordless root login, using recovery mode is allowed (through use of the security-misc package) on the host. To prevent adverse security effects posed by lesser adversaries with physical access to the machine, set up BIOS password protection, bootloader grub password protection and/or full disk encryption.

dsudo - default password sudo[edit]

dsudo is a Whonix ™ and Kicksecure ™ specific feature.

As long as still using the default password (not having changed sudo password), commands can be run as root without entering a password. This is useful for users having issues with changing the keyboard layout and for testing VMs.

Instead of using



dsudo [archive]

See Also[edit]



  1. Also see: Permissions.
  2. [archive]
  3. For example flash utilities for Linux require root access. In theory, it's conceivable of software bugs in firmware of hardware resulting in hardware compromise without prior root compromise. No such examples happening in the wild where known to the author at time of writing.
  4. An exploit or payload might require a function which is unavailable inside the sandbox.
  5. In new builds of Whonix version Earlier Whonix builds did not lock the root account by default and should be locked.
    • Applications supposed to be run as user but run as root might create root owned files. These file permissions error can lead to additional issues.
    • Inter process communications such as with dbus might be broken.
  6. No longer expiring the root account since this broke adduser, see: [archive] (To prevent SSH login, see: Linux Locking An Account [archive]. This might prevent other login methods but this requires further investigation.)
    sudo chage --expiredate 0 root

  7. Quote [archive] Joanna Rutkowska, security researcher, founder and advisor (formerly architecture, security, and development) of Qubes OS:

    One application can sniff or inject keystrokes to another one, can take snapshots of the screen occupied by windows belonging to another one, etc.

  8. If an application is compromised with an exploit due to a security vulnerability, it can be used as malware by the attacker. Once/if the application is not effectively confined by a mandatory access control (MAC) framework like AppArmor or firejail, it can compromise the user account where it is running and then proceed from there.
  9. Unless perhaps advanced users manage to run a different X server on a different virtual console. This might not be possible, secure. Depends on if the exclusive lock of X can be suspended while using an X server in a different virtual console. This has not been researched.
  10. 12.0 12.1 This step might be unnecessary. Not researched yet.
  11. Pressing Alt + Crtl + F7 results in tty2. This is to make these instructions compatible with most Linux distributions as well as Qubes.
    • Most Linux distributions login CLI virtual consoles on tty1 (Alt + Crtl + F1) by default and X Window System on tty7 (Alt + Crtl + F7).
    • Qubes X Window System by default runs on tty1. (Alt + Crtl + F1)
    tty2 (Alt + Crtl + F2) will be most most users an unused virtual console which can be used for the purpose of this chapter.
  12. A X Window System non-root user cannot sniff key strokes of different (non-)root users utilizing a different virtual console (tty).
  13. Non-simplified: applications run by user user in a different virtual console or run through systemd (user) services can be left running.
  14. su is sometimes incorrectly referred to as the superuser command. It allows [archive]:

    ... a change to a login session's owner (i.e., the user who originally created that session by logging on to the system) without the owner having to first log out of that session.

    Although su can be used to change the ownership of a session to any user, it is most commonly employed to change the ownership from an ordinary user to the root (i.e., administrative) user, thereby providing access to all parts of and all commands on the computer or system.

    By comparison, sudo makes it possible to execute system commands without the root password.

  15. Implemented in package security-misc [archive].
  16. sudo chmod 4755 /bin/su
    sudo chmod 4755 /usr/bin/su

  17. security-misc /etc/securetty [archive] is empty by default.
  18. When trying to login as root in a virtual console it will reply:

    Login incorrect.

    Without previously asking for a password. This is not the worst case for usability and is better than asking for password and then failing.
  19. sudoedit will not follow symlinks, therefore realpath is used.
  20. [archive]

text=Jobs in USA
Jobs in USA

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png

Have you contributed to Whonix ™? If so, feel free to add your name and highlight what you did on the Whonix ™ authorship page.

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.