Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a server environment for which the only methods of login would be SSH or local terminal in the datacenter. I have set this up to allow a specific user to login only with a key, not password (explicitly disabled). This user also has no password set.

Because of the things this user needs to do on the server, I have granted password-free sudo access, using (in the sudoers file):

username ALL=(ALL) NOPASSWD: ALL

Obviously, this can be a security issue. I need to ensure that the user cannot login to the server by any means other than SSH, using our closely guarded SSH keys. All SSH logins are extremely well protected, and locked to a specific IP address too, so that coupled with the key-based login, is secure (as it can be). I wish to eliminate the ability to login via our datacenter to ensure that the user cannot login from there, and only SSH.

How do I prevent those unauthorized access attempts?

share|improve this question
    
"This user also has no password set." This means...? –  Ignacio Vazquez-Abrams May 29 '13 at 12:39
    
A user on linux doesn't need to have a password –  John Porter May 29 '13 at 12:52
    
That doesn't answer the question. –  Ignacio Vazquez-Abrams May 29 '13 at 13:00
    
Have you considered setting a password on the user that is 30+ random characters (some almost impossible to type) to prevent non-SSH logins? –  killermist May 29 '13 at 13:06
    
That's a good idea. –  John Porter May 29 '13 at 13:13

2 Answers 2

up vote 1 down vote accepted

You could set a password on the user that is 30+ random characters (some almost impossible to type) to prevent non-SSH logins.

Though, this wouldn't stop the user from changing the password via SSH, and then using the datacenter terminal for direct access.

share|improve this answer
    
I've used the massive password idea, and it feels safer. As added in a comment above, the SSH is safe as it's key based and the machine that has the key is in my office. Thanks for your help. –  John Porter May 29 '13 at 13:33

I've always found a better solution is to set the password hash (in /etc/shadow) to an invalid value. I typically use the string %%NP%%. This effectively turns off password authentication for this user, and prohibits any sort of brute force cracking of the password. Given that no input into the password hashing algorithm will ever match the hash in the shadow file, this is extremely secure.

For Linux, you can instead of (or in addition to) the above, set access control parameters in /etc/security/access.conf. There are several examples in that file that should get you what you need. One caveat with this approach is that you can very easily lock root from being able to login from the console, which is a very bad idea in an emergency.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.