1

I wanted to ask how I can use the same authentication (private and public key SSH) for the root user and for another user (sudo user) on a VPS.

Or, in terms of security, it is best to make the process of creating and loading the key (I use puttygen) directly as a sudo user?

Disabling then the root login and without applying key authentication on root? Is this safe?

Thank you very much in advance for the help, I am starting to go crazy.. :(

1

Lots of different (separate) questions here...

Practical Considerations

To use the same keypair for multiple users, you can simply copy the contents (some, or all) of ~/.ssh/authorized_keys into another user's ${HOME}/.ssh/authorized_keys file. You'll need to make sure permissions on the .ssh directory and authorized_keys file are sufficiently tight or the SSH server may error out and refuse to process it. For an idea: only the current user needs access to those files, and they don't need to be able to write to or execute them, so a permission of 400 for the file and 500 for the directory (it needs execute so you can list its contents) should be fine. See here for info on the permission masks if you're unfamiliar.

Security Considerations

First, it's always a good idea to disable root login entirely over SSH, and set a separate (secure) root password on the box. sudo is just about the same level of security as su if your sudoers users have secure passwords; if not, it's not.

If you find yourself frequently needing root, you should look into ways to give targeted, specific permissions to users to satisfy the most common use cases of how you will use the server. This will reduce the need to login as root, which is always an elevated risk due to the wide-open permissions.

To further harden your SSH server, you should:

  • Change its port from the default 22 to something with a 5-digit number (less than 65536, due to the port number being a 16-bit value)
  • Disable password-based SSH login for all users (not only root)
  • Use strong keypairs with 2048-bit or 4096-bit private keys. Always use RSA, not the weaker algs such as DSA.
  • Set strong passwords for all sudoers as well as root.

The question of whether to re-use the same keypair goes away if you disable root login. If you need multiple regular users, and you are the only actual human being who will be logging into the server, I don't see any harm in re-using the same key pair by copying the authorized_keys file. If you will have multiple tenants on the box, each person should have their own key pair.

  • binding ssh to a port above 1023 is just asking for trouble since anybody on the system can bind there and steal credentials. Other recommendations are good. Except I'd avoid using sudo unless one needs to change SELinux roles, see: dmitry.khlebnikov.net/2015/07/… – galaxy Jul 18 '15 at 13:08
  • it's always a good idea to disable root login entirely over SSH, - did you mean password-based login? or root login entirely (makes a problem for remote system)? – EPo Aug 20 '18 at 8:27
0

To have authentication for multiple users, just add the public SSH key to both the normal user's ~/.ssh/authorized_keys file and to root's ~/.ssh/authorized_keys file. Then you can select which account to log on to by choosing the username in your client program.

It used to general best practice to disable root login entirely and always use a normal user to log on and use sudo or su. However, with public key authentication, the risk of someone brute-forcing your key is minimal. If you do not set a password for the root user then a lot of people would say it's ok to log in as root. If you want an added layer of security, disable root login, set a password for a normal user (so sudo asks you for it when you use it) and use public key authentication for the normal user to log in.

0

Thank you very much! So, I have:

  • Created public and private keys with PuttyGen (SSH-2 RSA, 4096 bits and added a passphrase);
  • Uploaded public key on server (before for sudo user and then for root);
  • Changed number of port;
  • PermitRootLogin no, PubkeyAuthentication yes, PasswordAuthentication no.

In this way:

  • If I try to login as root or sudo user and I haven't key private on Putty, I have "Disconnected: No supported authentication methods available (server sent: publickey)", no passphrase asked;
  • If I try to login as root + key private = it asks passphrase but then error "Server refused public-key signature despite accepting key" and "Disconnected";
  • If I try with sudo user + key private + correct passphrase = I can login

Now access to SSH should be 99% sure, right?

Thank you very much

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.