Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to make sudo command to support SSH private keys, so that when the user logins using a private key then he/she could sudo without typing a password.

This would allow storing the UNIX sysadmin passwords in an encrypted cold storage and never need to access them, assuming the users use secure private SSH keys always to login on the server.

share|improve this question
    
askubuntu.com/a/135838 If you put those users into a group, you sure can! –  Rob Oct 24 '12 at 21:07
    
try sudo visudo and change your password to NOPASSWD: ALL see if that works –  AlanTuring Oct 24 '12 at 21:08
1  
@AlanTuring That would also work for users in that group who identified via a password. –  Xyon Oct 24 '12 at 21:27
    
@AlanTuring That would effectively decrease the security of the server - I want only certain users, not all, sudo –  Mikko Ohtamaa Oct 24 '12 at 22:14
    
It's possible to give priviliges to specific users. See my answer. –  Isaac Rabinovitch Oct 26 '12 at 8:21

2 Answers 2

up vote 3 down vote accepted

This is not possible without some serious code changes to sudo and sshd. Sudo doesn't know about login methods, and ssh doesn't publish to other programs anything that would indicate whether public key, password, or some other mechanism was used for login.

As someone else said, you can use the NOPASSWD option in sudoers - this would apply to specified users always, though, not only when they use ssh with private keys.

If you really want, there may be tricks you can do with a suid program that checks the sshd log and locks/edits the sudoers file to let that user do a no-password sudo, and a periodic task to revoke this permission.

All that said, I think this is a bad idea. Requiring a password for privileged commands has a couple of nice benefits that private key SSH doesn't. Notably, it lets you have timeouts for the auth (password must be re-entered, not true for ssh sessions), it lets you have password minimums and rotation (unlike ssh keys, which have a passphrase outside the server's control).

share|improve this answer
    
"It can't be done" is not an answer, especially when it can be done. –  Isaac Rabinovitch Oct 26 '12 at 22:58

No stored passwords or keys required. You can get the result you want by granting the user no-password acccess in /etc/sudoers. Just add the following line:

user ALL=(ALL)       NOPASSWD: ALL

Be sure to use visudo to edit sudoers. You might want to give the sudoers man page a quick look so you understand what you're doing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.