Are there risks installing Dropbox using root on Unix?

Question

I have installed Dropbox to my Unix server via SSH as root.

I'm wondering if this was a bad idea as Dropbox is now contained under the the root home folder.

Are there any additional security concerns I should be aware of in comparison to installing it as a different user that isn't root?

Short answer -- "yes". Never run anything as/in/with root unless you know what you're doing AND have a good reason to be doing it! — mrunion, Jan 31, 2013 at 5:04
No one can be sure. I can't tell you what users will upload to dropbox, and what contents of the files will have what effects. If no one does anything malicious, then you'll probably be fine. It's a risk you have to decide for yourself whether you're willing to take it or not. — mrunion, Jan 31, 2013 at 5:08
Thank you. I think I might as well make the effort, remove it and install using a different account. — Luke Franklin, Jan 31, 2013 at 5:13
"SSH as root" > You already have a security issue. Never allow people to ssh in as root. ssh as a regular user, THEN sudo. — cpast, Feb 1, 2013 at 6:34

davidgo · Accepted Answer · 2013-02-01 06:31:49Z

There are greater risks, which I'd imagine come from 2 sources -

The dropbox client you are running runs as root. If there is anything that is open to hacking or overflows in the dropbox client (or if it can update itself, or is a trojan) your entire system can be compromised - whereas if its running as another user the damage a compromise can do is more limited.
Presumably in order to access (or at least delete or modify) the files on your box you need to be root (or your permissions are really screwed up for those files !). This encourages dangerous behaviours, and again, the consequences of a mistake are much greater.

1 Answer 1