The Kali Linux distribution is going to switch to a new security model by defaulting to a non-root user starting with the upcoming 2020.1 release.
This change will come with the release of the 2020.1 version scheduled for late January 2020, but users can already test it via the daily builds.
They will also be able to test it by downloading and running the weekly images released until Kali 2020.1 will be officially available.
"New year is a good time for major changes, and in that spirit we would like to announce a major change in the Kali security model releasing in the upcoming 2020.1 release - Default Non-Root User," the Kali Linux team announced on Twitter.
Increased usage as primary OS, fewer tools requiring root
This move has been prompted by the increasing number of users that adopted Kali as a day to day operating system due to the Debian-Testing-based operating system's general stability.
"While we don’t encourage people to run Kali as their day to day operating system, over the last few years more and more users have started to do so (even if they are not using it to do penetration testing full time), including some members of the Kali development team," Kali team lead Jim O’Gorman said.
"When people do so, they obviously don’t run as default root user. With this usage over time, there is the obvious conclusion that default root user is no longer necessary and Kali will be better off moving to a more traditional security model."
Additionally, Kali's dev team based this move on the fact that over the years a lot of the security tools included with the distro no longer need root access to provide users with full access to all their features, with some of them even going as far as coming with defaults that prevented their use as the root user.
"Dropping this default root policy will thus simplify maintenance of Kali and will avoid problems for end-users," O’Gorman added.
These are some of the changes end users will notice after the non-root user will be implemented:
kali password kali. No more root/toor. (Get ready to set up your IDS filters, as we are sure this user/pass combo will be being scanned for by bots everywhere soon).• On install, Kali will prompt you to create a non-root user that will have administrative privileges (due to its addition to the
sudo group). This is the same process as other Linux distros you may be familiar with.• Tools that we identify as needing root access, as well as common administrative functions such as starting/stopping services, will interactively ask for administrative privileges (at least when started from the Kali menu). If you really don’t care about security, and if you prefer the old model, you can install kali-grant-root and run
dpkg-reconfigure kali-grant-root to configure password-less root rights."All that said, we are still not encouraging people to use Kali as their day to day operating system," O’Gorman further explains. "More than anything else, this is because we don’t test for that usage pattern and we don’t want the influx of bug reports that would come with it.
However, for those of you that are familiar with Kali and want to run it as your day to day platform, this change should help you out a lot. For the rest of you, this should give you a better security model to operate under while you are doing assessments."
Windows 10 undercover mode
Kali Linux also added an 'Undercover' mode with the release of 2019.4 during late November 2019 that can be used to instantly make the Kali desktop look almost identical to a Windows 10 one.
This works by enabling a custom Kali theme designed to look like a Windows 10 one to the casual view or someone looking at your desktop in passing.
"Say you are working in a public place, hacking away, and you might not want the distinctive Kali dragon for everyone to see and wonder what it is you are doing. So, we made a little script that will change your Kali theme to look like a default Windows installation," Kali's devs said.
"That way, you can work a bit more incognito. After you are done and in a more private place, run the script again and you switch back to your Kali theme."
To enable the Undercover mode in Kali Linux 2019.4, you should perform these steps:
- Open Terminal
- Type kali-undercover and press enter.
- Undercover mode will be activated and your desktop will now look similar to Windows. You can now close the Terminal window.
Once you're done with the Undercover mode, you have to run the kali-undercover script again to switch back to your normal Kali theme.
The kali-undercover script can also be run using Kali's desktop search as shown in the GIF embedded above.