0

I have a linux server (Ubuntu 14) that I access using root and SSH keys (i.e. no root password). I have also created a non-root-user (and a corresponding non-root-user's-password) with sudo privileges.

My web host recommends disabling root for security reasons, and then using sudo when needed.

There are 2 issues I'm trying to get my head around:

  1. If I disable root, then I'm pretty sure I won't be able SSH into my server with the root user (root@ip-address), so I'll be using the non-root-user and non-root-user's-password. But this doesn't seem secure because someone could be listening in on the network and steal the username and password.

  2. If I disable root, and then use the sudo command from the non-root-user, how will the server authenticate that I am allowed to have root access? Will it use the SSH keys to do so?

Update: I've been thinking this wrong all along. Someone just reminded me that when one uses sudo, one is asked for the non-root-user's-password, not the root password. So the answer is obvious then.

Improve this question

2 Answers 2

Reset to default
4

The point of disabling SSH root login is to require from you two passwords to become root remotely - one from a standard user that has SSH access, then from that account, to root. This prevents attackers from guessing root passwords remotely - they have to guess 2 passwords to get root remotely.

But this doesn't seem secure because someone could be listening in on the network and steal the username and password.

The "S" in SSH means secure - as long as you are using SSHv2 and strong ciphers (check your sshd_config against this - https://stribika.github.io/2015/01/04/secure-secure-shell.html - if worried) there is not a useful possibility that anyone can sniff anything unless your keys are compromised.

sshd checks your password when you login using sshd - commands you execute thereafter are not checked by sshd - including sudo, su, etc.

Improve this answer
7
  • "then from that account, to root." -- okay... when I do a sudo from "that account," will the server ask me to enter a password? What password is this? After all, I don't have a root password.
    – thanks_in_advance
    Apr 28, 2015 at 1:09
  • 1
    It will ask you for whatever password you configure it to ask for. Typically, you either configure it to ask for no password or to ask for the password of the current account.
    – David Schwartz
    Apr 28, 2015 at 1:14
  • sudo will ask you for the root password (that's sudo doing that, not sshd per se.) then, if it's right, it will give you a root shell.
    – user441827
    Apr 28, 2015 at 1:35
  • @user441827 But if there's no root (it's been disabled), then what password will sudo ask for?
    – thanks_in_advance
    Apr 28, 2015 at 2:09
  • @DavidSchwartz I've already set up the non-root-user with a non-root-user's-password , and it's part of the sudo group, and I never set up a sudo or root password for it (my set-up has no root password, I log-in with SSH keys). So where am I supposed to configure this extra password?
    – thanks_in_advance
    Apr 28, 2015 at 2:11
1

SSH stands for Secure Shell. No password is ever sent in the clear; it uses public-key cryptography to verify your identity and secure communications. Works for root, works for everyone.

If you add non-root-user to the appropriate access list (allowing it to sudo), then you can manage your server with full power using that account.

Improve this answer
5
  • But when I use non-root-user to sudo, will the server ask me to enter a password (as it typically does when there is a root user)?
    – thanks_in_advance
    Apr 28, 2015 at 1:10
  • Not if you configure it not to.
    – David Schwartz
    Apr 28, 2015 at 1:14
  • And, even if you do enter a password, it will be encrypted before it is written to the network.
    – Scott - Слава Україні
    Apr 28, 2015 at 3:20
  • 1
    @user1883050: I’m not saying that you should do this — that’s for you to decide — but, FYI, you can delete your own old comments.  Just click on the red circle with the ⓧ (x) at the end (it will appear when you move your mouse there).
    – Scott - Слава Україні
    Apr 28, 2015 at 17:47
  • @Scott LOL... thanks... I hadn't realized one could do that. I will examine and delete the ones that are now unnecessary.
    – thanks_in_advance
    Apr 28, 2015 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .