Do superuser things with normal user

Question

EDIT

Read answer of janos below.

It's more use SSH-keys to access a root directly.

---

I want to secure the SSH access to my server. One thing I read everywhere is to disable the root user login.

To still have access via SSH I created another user via sudo adduser john

How can I still do root things with this account?

sudo command asks for a password of the user but gives john not in sudoer file. Action will be reported. When I use su I log in as root which I'm going to disable.

How can I stil do root things with the normal account john?

Answer 1

You should edit /etc/sudoers using the visudo command and add a line for the user john.

Probably you will want to add a line like john ALL=(ALL) ALL. Then you can issue commands using sudo (running as john) and, if desired, disable the root user, or at least use a very strong password for it - this would be my choice.

Besides, most versions of SSH should have root login disabled by default; that means you can't login as root over SSH, but you can SSH as user and then become root with su. If in doubt, check the PermitRootLogin statement in the /etc/ssh/sshd_config file. From the manpage:

   PermitRootLogin
          Specifies whether root can log in using  ssh(1).   The  argument  must  be
          ``yes'',  ``without-password'',  ``forced-commands-only'', or ``no''.  The
          default is ``yes''.

Answer 2

• If you're already logged in as root, using sudo is pointless.

• To allow john to gain root privileges, it suffices to execute

  usermod john -G admin
  

  in a Ubuntu default installation, since it adds john to the group admin (implies root privileges).

  For other distributions, you can consult /etc/sudoers for a group with this privilege.

• Disabling root is nice, but a user with root privileges can still do anything he wants.

  Not logging in as root only has advantages if you do it for any of the following reasons:

  • Preventing accidental changes to your system (rm -rf /, malware, etc.).

    sudo su lets you become root once you logged in as a user with root privileges.

  • You use something else than the user password to authenticate (e.g., private keys).

    In this case, the sudo command still requires the user password, so it adds an extra layer of security (unattended laptop, etc.).

Answer 3

It is worth noting that permitting root login with ssh is less insecure than the practice of using su root. This post on the Debian mailing list by Simon Kirby explains it very well:

http://lists.debian.org/debian-security/2002/06/msg00418.html

Permitting root login with ssh keys only might be more secure than the practice of sudo, but I'm not an expert. For what it's worth, the setting for that is:

PermitRootLogin without-password

Answer 4

Disable root login via ssh is smart. But there is no reason not to su to root once you login. Make sure both accounts have strong passwords and install fail2ban to prevent forest fires - sorry, crack attempts.