undefined | Better HN

0 pointsSae5waip11y ago0 comments

Did you ever stop and think about this or are you just repeating something you read on "Hacker""news"?

Getting by /without/ direct SSH root access is often impractical (think about scp), and without-password is a secure way to have it.

Also, the more people know about "without-password", the less people will set PermitRootLogin to "yes".

0 comments

jfindley11y ago

Requiring admins to ssh to a different, unique-to-them, user, and use sudo from there for any operations requiring root is much better.

It's far easier to audit what's been done to the server, which is important not just for compliance but also for figuring out why something's broken suddenly.

It also means that you get to have your own shell history, your own shell settings, your own vim settings, etc, etc.

In general, having proper deployment, log collection and config management tools in place tends to mean you rarely need to scp files around at all - and the cases when you do, you can work around this by scping them to some other dir, and moving them locally with a sudo command.

shabble11y ago

...which is fine up until someone forgets to use visudo and buggers up the sudoers file so nobody can get back in to fix it.

A user login followed by su to root is a valid alternative, but I wouldn't have a problem with allowing key-only root access via sshd either.

You'd want the root key/password to be very tightly controlled for the reasons you mention, but having it set is (IMO) a worthwhile backup plan for when things go wrong.

michaelmior11y ago

Why do you need root access for scp? Just scp the file as a regular user and then use sudo to copy it into place.

Sae5waipOP11y ago

tl;dr: "disallow root login entirely, everything else is bad" is cargo culting.

I said "impractical", not "impossible". Of course I can use sudo. But it's more work. I require root access a lot. It adds up quickly.[2]

And I hate typing passwords/passphrases. In fact, many of my passwords I can't remember. I've got an SSH agent for that, which reduces passphrase entry to yes/no (tab-space/space, actually).[1]

Also, I prefer my normal user account not to be a sudoer at all.

Besides, please consider that disallowing root access actually only gets you protection against root password guessing anyway. The "stolen key + passphrase" scenario in a sibling subthread is so absurd I felt the urge to bang my head against my desk. Sudo won't help you there either.

[1] Now please don't suggest "passwordless sudo".

[2] And there is another inelegance: /home is usually on a different partition than /, so your way will involve an additional copy. If /home is even large enough to fit that file.

michaelmior11y ago

[1] Why shouldn't I suggest it? Apparently it's obvious, so it would be nice to share. [2] I'm not sure where you get that /home and / are usually on different partitions. There's usually the same partition on machines I've administered. But if that is the case, you can find/create a suitable folder on the same partition (/var/tmp/ comes to mind)

I understand you didn't say impossible, but this doesn't really seem to be impractical to me at all.

1 more reply

j / k navigate · click thread line to collapse

0 comments

jfindley11y ago

Requiring admins to ssh to a different, unique-to-them, user, and use sudo from there for any operations requiring root is much better.

It's far easier to audit what's been done to the server, which is important not just for compliance but also for figuring out why something's broken suddenly.

It also means that you get to have your own shell history, your own shell settings, your own vim settings, etc, etc.

shabble11y ago

...which is fine up until someone forgets to use visudo and buggers up the sudoers file so nobody can get back in to fix it.

A user login followed by su to root is a valid alternative, but I wouldn't have a problem with allowing key-only root access via sshd either.

You'd want the root key/password to be very tightly controlled for the reasons you mention, but having it set is (IMO) a worthwhile backup plan for when things go wrong.

michaelmior11y ago

Why do you need root access for scp? Just scp the file as a regular user and then use sudo to copy it into place.

Sae5waipOP11y ago

tl;dr: "disallow root login entirely, everything else is bad" is cargo culting.

I said "impractical", not "impossible". Of course I can use sudo. But it's more work. I require root access a lot. It adds up quickly.[2]

And I hate typing passwords/passphrases. In fact, many of my passwords I can't remember. I've got an SSH agent for that, which reduces passphrase entry to yes/no (tab-space/space, actually).[1]

Also, I prefer my normal user account not to be a sudoer at all.

[1] Now please don't suggest "passwordless sudo".

[2] And there is another inelegance: /home is usually on a different partition than /, so your way will involve an additional copy. If /home is even large enough to fit that file.

michaelmior11y ago

I understand you didn't say impossible, but this doesn't really seem to be impractical to me at all.

1 more reply

j / k navigate · click thread line to collapse