Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On Windows from Vista and onwards, you have to press through an UAC dialog to perform something that requires admin rights like installing or uninstalling programs. On Linux to become root, you have to type your whole password.

Why is that? Why is there no passwordless sudo in any Linux distribution? Does the lack of password protection on Windows means that it is vulnerable in some way? If so, I'd like to see a proof of concept or a explanation of exactly how.

Update: Thanks for the answers, but they don't address my main question. To be more precise: If there isn't a vulernability in the Windows way, then why does Linux distros keep pestering the user to have to enter a password all the time? If there is a vulernability, then exactly how can it be exploited?

share|improve this question

closed as not constructive by Canadian Luke, Dave M, 8088, TFM, HackToHell Mar 27 '13 at 7:35

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

It depends on your user level on either system, actually.

Linux

Linux allows very extensive user rights management, most of which can be controlled through visudo (i.e. "The sudoers file"). You can control who has admin access (root privileges) and to what type of executables. They can either require a password to execute them -or- be allowed nopass, which is basically the equivalent to a Windows Administrator account.

Windows

By default, the first account created is an admin account (Since new windows, by default does not have a root (or "Administrator" in windows-lang) account). What that means is then your usual user account acts as a linux admin with nopass set and behaves pretty similarly.

Summary...

Long-story-short, it is really down to how you set up your system. Ubuntu, and most derivatives, act as windows in this way except they have nopass off - but your initial account is indeed an admin account.

Technically speaking, it is much better to use a traditional user account and only use elevated accounts for administrative work that shouldn't be terribly common after system set-up.

But, as @Eddy_Em said, all-be-it harshly, is that Windows sets up its users to not know/care about that type of restriction by default since XP. You could set-it up yourself and have a typical user account and an admin account, then you would have to supply the user/pass to make changes (just use the user level account to login).

share|improve this answer

No, neither Sudo nor UAC actually NEED a password. the point of both systems is to make sure the operator is absolutely sure they want to do something as admin, not to check to see if they ARE admin. you can;t use sudo or uac unless you are authenticated under a admin-capable account. this is why the sudo password on most systems is the users password itself. Note that in Vista, windows RUNAS support was weak, so some shops used UAC as a Runas alternative, but that is not its purpose.

share|improve this answer

The UAC can actually be disabled through Control Panel. The security of the application depends on the privileges of the logged on account and the exposed surface area of the system.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.