I have a few Linux servers at home that I regularly remote into in order to manage, usually logged into KDE Plasma as root. Usually they just have several command line windows and a file manager open (I personally just find it more convenient to use the command line from a remote desktop instead of directly SSH-ing into the system), but if I have an issue, I've just been absentmindedly searching stuff up and trying to find solutions using the preinstalled Firefox instance from within the remote desktop itself, which would also be running as root.
I never even thought to install uBlock Origin on it or anything, but the servers are all configured to use a PiHole instance which blocks the vast majority of ads. However, I do also remember using the browser in my main server to figure out how to set up the PiHole instance in the first place, and that server also happens to be the most important one and is my main NAS.
I never went on any particularly shady websites, but I also don't remember exactly which websites I've been on as root, though I do seem to remember seeing ads during the initial pihole setup, because it didn't go very smoothly and I was searching up error messages trying to get it to work.
This is definitely on me, but it never crossed my mind until recently that it might be a bad idea to use a browser as root, and searching online everyone just states the general cybersecurity doctrine to never do it (which I'm now realizing I shouldn't have) but no one seems to be discussing how risky it actually is. Shouldn't Firefox be sandboxing every website and not allowing anything to access the base system? Between "just stop doing it" and "you have to reinstall the OS right now there's probably already a virus on there," how much danger do you suppose I'm in? I'm mainly worried about the security/privacy of my personal data I have stored on the servers. All my servers run Fedora KDE Spin and have Intel processors if that makes a difference?
Could you elaborate on this? I'm genuinely surprised because Fedora just asks you if you want to have the option to log into root from KDE during installation, so I always just assumed that it's intended to be used that way.
I don't know the specifics on Fedora's installer, but normally that question is about disabling root account, not logging into a DE.
Not sure what else to elaborate here. There's a bunch of code that is not tested to be run as root. A whole class of exploits becomes unavailable, if you stick to an unprivileged user.
Say there's some exploit that allows some component of KDE to be used to read a file. If it's running under an unprivileged user - it sucks. Everything in user's homedir becomes fair game. But if it runs as root - it's simply game over. Everything on the system is accessible. All config, all bad config, files of all applications (databases come to mind). Everything.
Thank you.
This is also something I'm thinking about: All the hard drives mounted on the server is accessible to the only regular user as that is what my other computers use to access them. I'm the only one with access to the server so everything is accessible under one user. The data on those drives is what I want to protect, so wouldn't a vulnerability in either KDE or Firefox be just as dangerous to those files even running as the regular user?
Also, since my PC has those drives mounted through the server and accessible to the regular user that I use my PC as, wouldn't a vulnerability in a program running as the regular user of my PC also compromise those files even if the server only hosted the files and did absolutely nothing else? Going back to the Firefox thing, if I had a sandbox breach on my PC, it would still be able to read the files on the server right? Wouldn't that be just as bad as if I had been running Firefox as root on the server itself? Really feels like the only way to 100% keep those files safe is to never access them from an internet accessible computer, and everything else just falls short and is just as bad as the worst case scenario, though maybe I'm missing something. Am I just being paranoid about the non-root scenarios?
How does a "professional" NAS setup handle this?
You never log in as root. On every new VM/LXC I create, I delete the root password after setting it up so that my regular user can use sudo.
Run as your regular user and sudo the commands that need privileges.
Also if these are servers, run them headless. There’s no need for a GUI or a browser (use wget or curl for downloads, use your local browser for browsing)