up vote 1 down vote favorite
share [g+] share [fb]

For added security, we've disabled root login to server via ssh. We have a special ssh account that users need to login as, and then su as root in they require root access.

How can we setup passwordless logins using putty in this situation? I've setup passwordless login to the special ssh account, but we still need a password when we su as root.

If I'm not clear, feel free to ask me to clarify.

link|improve this question
86% accept rate
What OS are you using? – Bart De Vos May 25 '11 at 9:22
centos 5 (more char filler) – gAMBOOKa May 25 '11 at 9:29
feedback

3 Answers

up vote 1 down vote accepted

You could also change in your sshd configuration file the following line :

PermitRootLogin without-password

This will allow users to login as root but only using something else than password (kerberos tickets, ssh keys etc...)

link|improve this answer
feedback
up vote 1 down vote

Edit /etc/sudoers via the visudo command.

Add

specialsshaccount       ALL=(ALL)       NOPASSWD: ALL

Tip: http://www.sans.org/reading_room/whitepapers/basics/administration-shared-accounts_1271

link|improve this answer
I'm not very comfortable with this. This is not what I meant with passwordless login. I was expecting a client certificate based authentication. – gAMBOOKa May 25 '11 at 9:28
I'm confused now. Do you have SSH key based authentication working to specialsshaccount? If so, that's your "certificate based authentication." Once a user is logged in, how should they get root if it should be "passwordless?" – dmourati May 25 '11 at 9:34
I was hoping for putty to be able to intercept an attempt to login as root and use the private key file for authentication. – gAMBOOKa May 25 '11 at 9:37
1  
nope, putty is out of the picture here once you successfully get a shell on your centos box. You've disabled root ssh which leaves su/sudo. Read the link above for a better understanding. – dmourati May 25 '11 at 9:41
feedback
up vote 0 down vote

Start with adding the special account to the group: 'sudo'

%  useradd -G sudo specialsshaccount

Your system may already be configured to allow users in this group to sudo w/o password.

If not place this line in your /etc/sudoers (via visudo command)

%sudo ALL=NOPASSWD: ALL

protip: it's possible to allow only certain commands to execute without password (man sudoers)

link|improve this answer
your sudoers line needs to start with % – dmourati May 25 '11 at 9:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.