I've often come across posts on forums or other websites where you see people joking in such a manner about running/logging in as root as if it's something awful and everyone ought to know about it. However, there isn't much that a search reveals on the matter. It maybe widely known to Linux experts, but I really don't know why. I remember always running as root when I first tried Linux years ago (Redhat and Mandrake) and don't remember running into any problems because of that. There are actually some distros that have a bright red background with alert signs all over it as wallpaper for the root user (Suse?). I still use the "Administrator" account for regular use on my Windows installation and haven't ever run into any problems either.
These users have administrative access to the system, a permission level that allows them, and applications they run, to circumvent protection mechanisms (such as file system permissions), allowing them to do everything on a system. Malicious software loves unrestricted access.
As a simple example,
sudo rm -rf *
will delete pretty much everything on a Linux system, if you're in the root directory. It needn't be as obvious as that, or even malicious. Something like unexpectedly undefined variables in scripts that require root privileges can cause severe problems:
rm -rf $destinationDir/* # if the variable is undefined and the shell doesn't care, the result is: rm -rf /*
Therefore, the general recommendation is to use execute programs only with elevated permissions if it's really necessary.
It would be the equivalent of completely disabling UAC and running as admin for all users on a windows box. Malware can more easily install, drive by downloads are more effective, if there is a penetration they are now god on your computer. You just effectively remove user priviledges(generally bad practice). imho, if you haven't had a problem you have either been very lucky, have incredibly safe browsing habits, or the most likely....had a problem and didn't know it.
I have (at-least twice) written scripts which were supposed to browse the directory structure in a particular way and execute
rm -rf * in some directory. There was some bug, and the script ended up going to
"/" (root) directory and execute
rm -rf *. This is of course the example of the worst kind, but even lesser evil scripts or commands can cause serious damage to your system if running as root.
You have the sad misfortune of Microsoft and anti-viruses dealing with the issue. The administrator account (root) is meant to have unrestricted access (as stated by everyone). It can not only modify system files resulting in a machine that can not boot, but can access other user data (user permissions is not enough to secure data access and modification when physical access to the computer is available). Now on to what you do not "see."
It has been an unfortunate practice to always run a Windows machine as Administrator. There are good reasons for this such as the ability to become another user within a session sucked (Program installation would require logging out and logging in as admin and installing the application, which may even require being admin to run). The result is that your computer gets used for things you didn't expect, even if you didn't install the application.
The result is not that people are moving away from running as Admin, but Microsoft is brining permission control to the underlining structure of the OS UAC. What this means is that you are asked to give the application permission to run no matter who you are. Vista was really bad because it had two layers for Admin users, "Do you want to run this program?", "Ok, now that you are running this program, would you like to let it run?"
In Linux you see a very different philosophy. First off the OS does what you tell it, no double checking that you really meant to run an application. Second, the user doesn't get to do anything they want to the system. This means the system is safe from user mistakes, but the user can always escalate their permissions to the proper level if they desire. Microsoft has basically built a permission escalation layer separate from the user layer, will Linux/Unix has always had a design to escalate permissions which worked with users.
In linux, it mostly just keeps you (or an application acting on your behalf) from accidentally doing something dumb.
In Windows, you can't install many kinds of software without running in an account as administrator, because you don't have write access to the program files or windows folders. The worst kinds of malware need to be able to write to these areas to worm their way into your system.
If you're not running as an administrator and visit a compromised site that tries to install something like a hidden keylogger to steal passwords, bank information, or credit card numbers, that install will likely fail. If you are running as administrator, that install has a much greater chance of succeeding. The same principle holds true for linux systems.
They key here is that anti-virus software doesn't even enter into. These days, antivirus software is your last line of defense, not your first. The order of importance that I use to rate security measures goes like this:
- Keep your system (including application software) patched
- Do not run as administrator
- Use other safe internet habits
- Run a firewall
- Have a good offline backup (in this case, offline means "not accessible to your normal file system", which might actually mean using an online service)
- Run antivirus software
In fact, if you're doing enough of the other items correctly, anti-virus software isn't really necessary at all. But the important thing here is that running as administrator is a no-no.
Thankfully, this is now the default state in Windows 7. Even if your account has administrator privileges, it still runs "sandboxed" and merely gives you the right to elevate for a specific application on demand.