I have a linux server (Ubuntu 14) that I access using root and SSH keys
(i.e. no root password). I have also created a non-root-user
(and a corresponding non-root-user's-password
) with sudo
privileges.
My web host recommends disabling root for security reasons, and then using sudo
when needed.
There are 2 issues I'm trying to get my head around:
If I disable root, then I'm pretty sure I won't be able
SSH
into my server with the root user (root@ip-address
), so I'll be using thenon-root-user
andnon-root-user's-password
. But this doesn't seem secure because someone could be listening in on the network and steal the username and password.If I disable root, and then use the
sudo
command from thenon-root-user
, how will the server authenticate that I am allowed to have root access? Will it use theSSH keys
to do so?
Update: I've been thinking this wrong all along. Someone just reminded me that when one uses sudo
, one is asked for the non-root-user's-password
, not the root
password. So the answer is obvious then.