2

I SSH to a server with:

ssh user@host

and then I change to the root user with:

sudo -s

providing my own password NOT the root user password - as I understand this works because I am in the sudoers file.

Is there anyway to SSH/login and switch to the root user in one step even though I don't have the root user password?

The point being that I would like to avoid typing my password two times

  • Sure thing, simply register an SSH key in the root account, set PermitRootLogin prohibit-password in sshd_config, restart the SSH server (e.g. service ssh restart) and log on directly as root. Avoid using password authentication with SSH, especially whenever it concerns a sudoer or the superuser itself. – 0xC0000022L Jul 1 at 7:48
  • 1
    Note that if your SSH server is externally available (e.g., accessible from outside your local network), devices will try to connect to it as 'root'. As @0xC0000022L writes, it's not a good idea to allow password authentication (really at all, but especially for a sudoer/root). The thought of devices continuously trying to connect as root worries me (even though I use pubkey authentication), so I don't allow root login, but maybe that's just me. – singalongconflict Jul 1 at 14:52
  • 1
    @singalongconflict I think the worry is justified, however personally I am using a tarpit approach implemented via Netfilter and IP sets, so that potential attackers have a fairly hard time to brute-force anything. The IP sets allow entries to time out, so I am safeguarded against locking myself out. For root, if you allow it with key authentication, perhaps it's a good idea to limit access to particular IPs or IP ranges ... or use the firewall. – 0xC0000022L Jul 1 at 15:10
0

You have 2 easy ways to achieve this:

  1. You allow the root user to login through ssh, you can do this by editing the /etc/ssh/sshd_config file and setting the PermitRootLogin to true, this will allow root to connect through ssh.
  2. You create a custom script for your ssh user to automatically login as root. This can be done through the /etc/passwd file, you will notice your user will look something like :

your_user:x:1001:1001:Oqhax,,,:/home/your_user:/bin/bash

To run a custom script on login, you would change the /bin/bash portion and add your own script that will run whatever code you want, this can include something like sudo -s and then at the end of your custom script you can also call /bin/bash again I believe, so your passwd would look something like:

your_user:x:1001:1001:Oqhax,,,:/home/your_user:/bin/your_script

Beware that the second option will impact your ssh login behaviour, so for you to test this, make sure that you can deal with making a mistake and effectively being unable to log in with your user, so make sure you have a backdoor ssh access through another user or root as mentioned in option 1 at least temporarily for you to log back in and correct any mistakes until you have the setup working.

Update: Following up on comments below, it is worth mentioning this does not only affect the ssh login but any login of that user (I've approached this assuming that your requirement is for this user always to login as root and you don't wish to allow the actual root user to log in through ssh). It is also worth noting that this is as easier solution to what could be a much tighter and complex one that would apply to SSH only, your question doesn't go into a lot of detail.

As mentioned in the comments, you could also achieve this same behaviour through /etc/ssh/sshrc I just prefer to edit the raw /etc/passwd so that in the future it is very evident what is happening and it requires you to accomodate for the consequences, while sshrc is great but makes future troubleshooting a litle harder if you happen to forget how you have set up the system which let's be honest, happens a lot. But it is indeed a good habit to have to not expose the root user at all, this will give you much more flexibility in the future and to try things and to custom your sudoer permissions.

Hope this helps

| improve this answer | |
  • authorized_keys, sshrc all sensible means to achieve it, equally it could be done with pam_exec. But your approach does it unconditionally and completely neglects /etc/shells. Even matching the username with Match in sshd_config and applying ForceCommand to run whatever command is needed to impersonate root could do this unconditionally for SSH connections only. Your method affects everything, not just SSH connections. -1. – 0xC0000022L Jul 1 at 15:13
  • I understand where you are coming from, my intention was to provide an easy solution to someone who is quite obviously not very experienced with linux, it is worth mentioning this poses security concerns but it is a quick and easy way to get it working if we are taling about a device or solution that doesn't require much security. The moethod I proposed is simply to provide an alternative to the default bash on login adn to provide his own script and "control" the login behaviour of a particular user, ssh or not yes. I don't consider it an awful solution even though there are other ones – Tiago Carneiro Jul 2 at 12:38
  • His question also mentions .... anyway to SSH/login .... I assumed he meant "ssh login / console login" – Tiago Carneiro Jul 2 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.