5

Best practice is to remove the ability of 'root' to login over ssh. However, I need to run some Ansible commands and am currently connecting via a user called "amdhske" and then have set this user up to not need to enter password to do sudo otherwise Ansible needs to keep the user's password hanging around.

So what is the point of disabling root access in this case? Any attacker who gets in to the "amdhske" user account over ssh can then sudo the heck out of the server. I am guessing the only advantage here is that by choosing a lengthy random username makes it highly unlikely an attacker would know about it whereas 'root' is the default username for, well, 'root'. Is there any other reason?

9
  • What is the point? You have defeated the point by having a user that can run commands as superuser/sudo without entering a password. It serves no purpose for your usage case besides disabling another attack vector of course the attack vector that does exist is even worst then root being accessible over ssh.
    – Ramhound
    Jan 12, 2015 at 16:44
  • why is it worse? If anything it is slightly better as the attacker must guess the username?
    – Zuriar
    Jan 12, 2015 at 16:52
  • If you are at the point where an attacker is even attempting to attack your server they likely have social engineered somebody with knowledge of the username.
    – Ramhound
    Jan 12, 2015 at 16:58
  • 1
    I am sure Sony didn't think they would be hacked and 14TB of their data would be leaked either. How you solve your other problem, I can't help with, I can just tell you that is something you should look at.
    – Ramhound
    Jan 12, 2015 at 17:02
  • 1
    Which account name am I more likely to guess? "root" or "amdhske" ?
    – hymie
    Jan 12, 2015 at 17:15

3 Answers 3

4

Pretty easy. Two reasons:

  1. You can limit what you can sudo with no password with your user. You just enter the proper configuration in sudoers files:

    amdhske ALL=NOPASSWD: /usr/bin/somecommand
    

If you login with root, then you have all the permissions to do anything.

  1. Every script kiddie on earth knows that your superuser account name is root. So what username do you think they are going to try to brute-force, etc to your system? Right, root.

That it is why is a good security practice to disable root ssh login.

2
  • ...add too that some Linux distributions disable root user by default (e.g. Ubuntu...).
    – Hastur
    Jan 12, 2015 at 18:22
  • These arguments are not applicable to the Ansible use case. Jul 25, 2018 at 23:02
1

In order to address your issue with "Ansible" without disabling password question for sudo, you can sudo a trivial command like sudo ls and then continue on with sudo Ansible. This is just a work around though and you sudo expires after some time so it may not completely solve the problem.

PS. I understand that this is not addressing the OP's direct question but I am trying to address his/her root (pun intended) issue.

1

There are several things going on here, and I may miss some, but here goes.

  1. Security by obscurity: check your auth log some time. There are likely hundreds of root login attempts by automated scripts every day, and disallowing login by that user blocks some low hanging fruit.

  2. Legacy policies: it's not as big a deal with key-based authentication, but with older authentication models it was incredibly bad practice to leave root login open. These best practices have not changed because there is no real benefit to root login in the first place.

  3. Logging: If every user has their own account you can more easily tell who has done what on your system.

In addition, passwordless sudo would have been considered very poor practice not too long ago. It's only in the age of key-based authentication that this has become useful and secure. Users often do not even know their passwords so they can't provide them even if asked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .