Root access

m (→Modify the gainroot script: Closing tag properly)
m (Reverted edits by 5.188.211.16 (Talk) to last revision by sixwheeledbeast)
 
(81 intermediate revisions not shown)
Line 1: Line 1:
-
{{Midgard article}}
+
{{danger}}
 +
Having [[:wikipedia:Superuser|root]] access is an important step for users interested in modifying things "under the covers" of their tablets; without it, you won't have the necessary permissions to make those modifications. Root access is disabled by default on new tablets. Thankfully, the steps to enable root access are simple.
-
OK, first, the disclaimer: '''Doing whatever is stated on this page is not endorsed by Nokia in any way.'''
+
== Why do I want root? ==
-
''Warning: There have been reports of display failures (white with dim vertical stripes) after disabling rd mode and rebooting a new 770. If you get this, there is a hardware failure in your device and you need to return it and get a replacement.''
+
Root access is ''not'' required to install additional applications through Application Manager, open X Terminal or use your tablet in day-to-day operation.
-
Screenshot added: [http://www.circuitwizard.de/misc/2935.jpg Cracked screen]<nowiki>; </nowiki>[http://maemo.org/pipermail/maemo-users/2006-July/001605.html Screen bug Post].
+
If you want to edit the underlying system configuration, install applications ''through the command line'' or other low-level tasks, you ''will'' require root access.
-
= Recommended methods =
+
== rootsh ==
 +
<small>''Note: As rootsh is the simplest option, and does not require a desktop computer or running additional services, it is the recommended method for gaining root access.''</small>
-
== easyroot ==
+
<code>rootsh</code> is available in [[Extras]], and can be installed from the Application manager if you have the Extras repository enabled. It is also available directly from [http://maemo.org/downloads/product/Maemo5/rootsh/ maemo.org].
-
Install [http://nitapps.com/dists/chinook/user/binary-armel/easyroot_1.0-4_armel.deb easyroot] from [http://nitapps.com/ nitapps.com].
+
-
Then, from the shell, run <code>root</code>. This will give you a root shell.
+
Then, from the [[terminal|shell]], run:
 +
sudo gainroot
 +
(or <code>root</code> for short). This will give you a root shell.
-
== OpenSSH ==
+
== sudser ==
 +
<small>''Note: Some scripts require rootsh to run properly, so it's recommended to have both sudser and rootsh installed if you're using sudser.''</small>
-
# Enabled Extras (if you haven't already).
+
sudser adds the user to sudoers so you can use the <code>sudo</code> command to run commands as root.  
-
# Install OpenSSH (client and server).
+
-
# SSH into your tablet as root
+
-
## For local access, run <code>ssh root@localhost</code>
+
-
## For remote access, run <code>ssh root@''tablet's ip address''</code>
+
-
# Use the root password that the OpenSSH package asked you to enter to log in (in ancient OS versions you had to use the factory default "rootme" password).
+
-
= Securing root access =
+
It is available in Extras, and can be installed from the Application manager if you have Extras enabled.
-
At this point you should have gained root access to your device, and be looking at the root prompt:
 
-
<nowiki>#</nowiki>
+
Then, from the shell, run <code>sudo ''command''</code>. This will execute <code>''command''</code> with root privileges.
-
'''However, if your wi-fi network is not password protected, so might anyone else near you who has WiFi, SSH and a clue.'''
+
<small>''Note: Adding user to the sudoers without a password isn't best for security so use at own risk.''</small>
-
You still need to secure root-level access.
+
== OpenSSH ==
-
You also still need to secure the root account ("rootme" is a terrible password, and direct root log-in access is not necessarily required).
+
# Enable Extras (if it is disabled)
 +
# Install OpenSSH (client and server)
 +
#* This will prompt you to change the root password from the default, <code>rootme</code>
 +
# SSH into your tablet as root
 +
#* For local access, run <code>ssh root@localhost</code>
 +
#* For remote access, run <code>ssh root@''tablet's ip address''</code>
 +
# Use the root password entered at step (2) to log in
-
== Secure future root-level access ==
+
To debug issues with SSH connections, use the SSH '-v' option.
-
=== Modify the gainroot script ===
+
(To get SSH X forwarding ('-X' option) to work, you need to install ''xauth'' (or ''xbase-clients'') package and enable X forwarding in the SSH server configuration file on the machine where you're connecting to.)
-
<small>''Note: [[#easyroot|easyroot]] already does this.''</small>
+
-
'Fix' the original /usr/sbin/gainroot script to not to check for R&amp;D mode and allow root everytime.
+
== Research &amp; Development Mode (R&amp;D or RD Mode) ==
-
You can edit line
+
{{ambox|text=As R&D mode has other side effects beyond simply enabling root access (including several that may negatively impact battery life), it is ''not'' the recommended method for gaining root access. Use [[#rootsh|rootsh]] instead.}}
-
MODE=<code>/usr/sbin/chroot /mnt/initfs cal-tool --get-rd-mode</code>
+
{{main|R&D mode}}
-
to be
+
You can enable the R&D mode which enables you to execute <code>sudo gainroot</code> to get a root shell, simply follow the setup steps for flashing covered in [[Updating the firmware|updating the tablet firmware]], then execute
-
  MODE=enabled #<code>/usr/sbin/chroot /mnt/initfs cal-tool --get-rd-mode</code>
+
  sudo ./flasher-3.5 --enable-rd-mode -R
-
You can use vi editor for this, enter
+
You are now in R&D mode, and the sudo gainroot script's check will be satisfied.
-
vi /usr/sbin/gainroot
+
== On-Device Sudoers Edit (No External Dependencies) ==
 +
This covers how to get root access on-device. without any external downloads/dependencies, as well as advocates a more desktop-like approach to setting up your sudoers file.
 +
http://talk.maemo.org/showthread.php?t=94494
-
position cursor at '=' character, press 'a' key, enter 'enabled #', press Esc key and save and exit with 'ZZ' command (shift + zz). The edited line may look garbled but it is OK. CTRL+L refreshes screen in vi so you can double check before saving.
+
== A note on sudo ==
 +
This information is aimed at people who come to maemo from other linux distributions (Debian for example) that may have used sudo in a different way.
-
From now you can use the intended way how to gain root on the device in R&amp;D mode without having to set it.
+
In fremantle (Maemo 5) sudo is a key part of the system. It is used by system processes that are started as the user to provide access (as root) when needed.
-
$ sudo gainroot
+
Examples of this are:
 +
Media Tracker.
 +
The firmware version on the 'Settings' > 'About Product' page.
-
=== Set user password ===
+
Both of these will malfunction if there are problems with sudo.
-
Set the [http://en.wikipedia.org/wiki/Password_strength password] for 'user':
+
Sudo relies on <code>/etc/sudoers</code>, a configuration file that details who can run what commands. <code>/etc/sudoers</code> is traditionally modified by using the 'visudo' command. DO NOT DO THIS ON MAEMO. In maemo sudoers is regenerated periodically from config snippets in <code>/etc/sudoers.d/</code>, using <code>visudo</code> can cause the slow death of your system as your edit gets pushed further down /etc/sudoers.
-
passwd user
+
For those who don't know, <code>/etc/sudoers</code> works on a last match principle, so if your edit conflicts with entries above it, it will break those entries.
-
 
+
-
Note: when typing a password nothing will be shown on the screen.
+
-
 
+
-
Now, for the future, unless you want to keep SSH-ing from another machine, a clever move is to add "user" to sudoers:
+
-
 
+
-
echo "user ALL = PASSWD: /bin/su" &gt;&gt; /etc/sudoers
+
-
 
+
-
this way your password will be asked in order to become root. Or
+
-
+
-
echo "user ALL = NOPASSWD: /bin/su" &gt;&gt; /etc/sudoers
+
-
 
+
-
in order to become root without having to type your password.
+
-
 
+
-
Please keep in mind that password will be cached, so you won't have to type it ''every'' time you need to sudo.
+
-
 
+
-
Note that if you require a password to become sudo, some built-in apps (notably Application Manager) will appear to not load while they wait silently in the background for the password to be entered. The can be avoided by running a command in the xterm with sudo prior to lauching the app, so as to appease sudo when the OS calls it.
+
-
 
+
-
Ok, from now on all you have to do, in your Xterm session, to get root is to write:
+
-
 
+
-
sudo su -
+
-
 
+
-
=== Secure the root account ===
+
-
 
+
-
'''You ''MUST'' change (or disable) your root password before continuing!'''
+
-
 
+
-
Else you will be walking around with a device that can be accessed using a TRIVIAL and well known password.
+
-
 
+
-
==== Change root password ====
+
-
 
+
-
To change root password (as root user):
+
-
 
+
-
passwd
+
-
 
+
-
...when asked, input (twice) your [http://en.wikipedia.org/wiki/Password_strength new password].
+
-
 
+
-
'''It is still recommended to limit root logins to local console only in most cases.'''
+
-
 
+
-
==== Disable root login ('''highly suggested''') ====
+
-
 
+
-
'''NOTE:''' Do not perform this step without having completed Step [[Root access#Modify the gainroot script|Modify the gainroot script]] or [[Root access#Set user password|Set user password]]
+
-
 
+
-
After you gained access as root user:
+
-
 
+
-
passwd -l root
+
-
 
+
-
In this case, from now on you won't be able to login directly as root user -- not from ssh and not from the local console.
+
-
 
+
-
To get a root prompt:
+
-
 
+
-
sudo su -
+
-
 
+
-
=== Disabling root login when using OpenSSH ===
+
-
 
+
-
This step is semi optional. Definitely recommended for most installations, though.
+
-
 
+
-
When using dropbear as ssh server, you can disable root logins via ssh: just add the option "-w" to DROPBEAR_EXTRA_ARGS in /etc/default/dropbear:
+
-
 
+
-
DROPBEAR_EXTRA_ARGS="-w"
+
-
 
+
-
After that, restart dropbear:
+
-
 
+
-
/etc/init.d/dropbear restart
+
-
 
+
-
A remote root login via ssh is then no longer possible. So you have to use the "user" account (you should give the user a password beforehand).
+
-
 
+
-
=== For Windows Users Only ===
+
-
 
+
-
Obviously the same trick works also in Windows, but you have to use a (free or commercial) SSH enabled client:
+
-
*[http://www.celestialsoftware.net/telnet/ Absolute Telnet]
+
-
*[http://www.vandyke.com/download/securecrt/index.html SecureCRT]
+
-
*[http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY], etc...
+
-
 
+
-
== R&amp;D Mode ==
+
-
<small>''Note: As R&D mode has other side effects beyond simply enabling root access (including several that can negatively impact battery life), it is ''not'' the recommended method for gaining root access. Use [[#easyroot|easyroot]] instead.</small>
+
-
 
+
-
You can enable the Research &amp; Development mode (R&amp;D or RD mode, which enables you to execute <code>sudo gainroot</code> to get a root shell, simply follow the setup steps for flashing covered in [[Upgrading_tablet_OS#Flashing_your_Nokia_tablet|Upgrading tablet OS]], then execute
+
-
 
+
-
sudo ./flasher-3.0 --enable-rd-mode -r
+
-
 
+
-
You are now in R&D mode, and the sudo gainroot script's check will be satisfied.
+
 +
The 'correct' way to do this would be to put your entry in a file in <code>/etc/sudoers.d/</code>. I leave the detail of this up the experience of the end-user. Just be advised that using <code>visudo</code> runs the risk of subtly breaking your system.
-
[[Category:Users]]
 
-
[[Category:Midgard wiki]]
 
[[Category:Wiki page of the day]]
[[Category:Wiki page of the day]]
 +
[[Category:Power users]]

Latest revision as of 08:50, 11 April 2019

Image:Ambox_notice.png
 Some instructions here may cause serious problems. When unsure, see General precautions
Backing up your data is recommended. In case of trouble you might need to re-flash your device.


Having root access is an important step for users interested in modifying things "under the covers" of their tablets; without it, you won't have the necessary permissions to make those modifications. Root access is disabled by default on new tablets. Thankfully, the steps to enable root access are simple.

Contents

[edit] Why do I want root?

Root access is not required to install additional applications through Application Manager, open X Terminal or use your tablet in day-to-day operation.

If you want to edit the underlying system configuration, install applications through the command line or other low-level tasks, you will require root access.

[edit] rootsh

Note: As rootsh is the simplest option, and does not require a desktop computer or running additional services, it is the recommended method for gaining root access.

rootsh is available in Extras, and can be installed from the Application manager if you have the Extras repository enabled. It is also available directly from maemo.org.

Then, from the shell, run: 

sudo gainroot

(or root for short). This will give you a root shell.

[edit] sudser

Note: Some scripts require rootsh to run properly, so it's recommended to have both sudser and rootsh installed if you're using sudser.

sudser adds the user to sudoers so you can use the sudo command to run commands as root.

It is available in Extras, and can be installed from the Application manager if you have Extras enabled.


Then, from the shell, run sudo command. This will execute command with root privileges.

Note: Adding user to the sudoers without a password isn't best for security so use at own risk.

[edit] OpenSSH

  1. Enable Extras (if it is disabled)
  2. Install OpenSSH (client and server)
    • This will prompt you to change the root password from the default, rootme
  3. SSH into your tablet as root
    • For local access, run ssh root@localhost
    • For remote access, run ssh root@tablet's ip address
  4. Use the root password entered at step (2) to log in

To debug issues with SSH connections, use the SSH '-v' option.

(To get SSH X forwarding ('-X' option) to work, you need to install xauth (or xbase-clients) package and enable X forwarding in the SSH server configuration file on the machine where you're connecting to.)

[edit] Research & Development Mode (R&D or RD Mode)

Image:Ambox_notice.png
 As R&D mode has other side effects beyond simply enabling root access (including several that may negatively impact battery life), it is not the recommended method for gaining root access. Use rootsh instead.

Main article: R&D mode


You can enable the R&D mode which enables you to execute sudo gainroot to get a root shell, simply follow the setup steps for flashing covered in updating the tablet firmware, then execute 

sudo ./flasher-3.5 --enable-rd-mode -R

You are now in R&D mode, and the sudo gainroot script's check will be satisfied.

[edit] On-Device Sudoers Edit (No External Dependencies)

This covers how to get root access on-device. without any external downloads/dependencies, as well as advocates a more desktop-like approach to setting up your sudoers file. http://talk.maemo.org/showthread.php?t=94494

[edit] A note on sudo

This information is aimed at people who come to maemo from other linux distributions (Debian for example) that may have used sudo in a different way.

In fremantle (Maemo 5) sudo is a key part of the system. It is used by system processes that are started as the user to provide access (as root) when needed.

Examples of this are: Media Tracker. The firmware version on the 'Settings' > 'About Product' page.

Both of these will malfunction if there are problems with sudo.

Sudo relies on /etc/sudoers, a configuration file that details who can run what commands. /etc/sudoers is traditionally modified by using the 'visudo' command. DO NOT DO THIS ON MAEMO. In maemo sudoers is regenerated periodically from config snippets in /etc/sudoers.d/, using visudo can cause the slow death of your system as your edit gets pushed further down /etc/sudoers.

For those who don't know, /etc/sudoers works on a last match principle, so if your edit conflicts with entries above it, it will break those entries.

The 'correct' way to do this would be to put your entry in a file in /etc/sudoers.d/. I leave the detail of this up the experience of the end-user. Just be advised that using visudo runs the risk of subtly breaking your system.

Retrieved from "https://wiki.maemo.org/Root_access"