Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Two question regarding sudo-login into an ubuntu-system (debian tips welcome as well):

  • Is it possible to require sudoers on my box to only login with publickey-authentication?
  • Is it possible to log which ip sudoers log in from and check that for "unusual activity" or take actions? I'm thinking about temporarily removing sudo-rights if sudoers don't log in from whitelisted IPs. Or is that too risky to be exploited?
share|improve this question
1  
What operating system? – Rowland Shaw Mar 25 '12 at 14:52
Oh, Sry. Ubuntu 11.10. – Fabian Zeindl Mar 25 '12 at 17:25
Your question seems to be confusing sudo with ssh. I think you meant ssh in all of those cases. And ssh allows one to do all of those. – Dan D. Apr 2 '12 at 1:34
No, i meant sudoers, since it's those accounts that shouldn't be compromised. I'm unfortunately in a situation where i have boxes with 30 users, 5 of them sudoers and i don't trust every one of them to know what they're doing. – Fabian Zeindl Apr 2 '12 at 6:26

1 Answer

up vote 0 down vote accepted

I found the answer to the first question here: http://serverfault.com/questions/238711/force-ssh-public-key-authentication-for-specific-users. Just add the following to sshd_config:

Match Group sudoers
PasswordAuthentication no
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.