Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Two question regarding sudo-login into an ubuntu-system (debian tips welcome as well):

  • Is it possible to require sudoers on my box to only login with publickey-authentication?
  • Is it possible to log which ip sudoers log in from and check that for "unusual activity" or take actions? I'm thinking about temporarily removing sudo-rights if sudoers don't log in from whitelisted IPs. Or is that too risky to be exploited?
share|improve this question
1  
What operating system? – Rowland Shaw Mar 25 '12 at 14:52
    
Oh, Sry. Ubuntu 11.10. – Fabian Zeindl Mar 25 '12 at 17:25
    
Your question seems to be confusing sudo with ssh. I think you meant ssh in all of those cases. And ssh allows one to do all of those. – Dan D. Apr 2 '12 at 1:34
    
No, i meant sudoers, since it's those accounts that shouldn't be compromised. I'm unfortunately in a situation where i have boxes with 30 users, 5 of them sudoers and i don't trust every one of them to know what they're doing. – Fabian Zeindl Apr 2 '12 at 6:26
up vote 0 down vote accepted

I found the answer to the first question here: http://serverfault.com/questions/238711/force-ssh-public-key-authentication-for-specific-users. Just add the following to sshd_config:

Match Group sudoers
PasswordAuthentication no
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .