1

For added security, we've disabled root login to server via ssh. We have a special ssh account that users need to login as, and then su as root in they require root access.

How can we setup passwordless logins using putty in this situation? I've setup passwordless login to the special ssh account, but we still need a password when we su as root.

If I'm not clear, feel free to ask me to clarify.

Improve this question
2
  • What OS are you using?
    – Bart De Vos
    May 25, 2011 at 9:22
  • centos 5 (more char filler)
    – gAMBOOKa
    May 25, 2011 at 9:29

3 Answers 3

Reset to default
1

You could also change in your sshd configuration file the following line :

PermitRootLogin without-password

This will allow users to login as root but only using something else than password (kerberos tickets, ssh keys etc...)

Improve this answer
1

Edit /etc/sudoers via the visudo command.

Add

specialsshaccount       ALL=(ALL)       NOPASSWD: ALL

Tip: http://www.sans.org/reading_room/whitepapers/basics/administration-shared-accounts_1271

Improve this answer
4
  • I'm not very comfortable with this. This is not what I meant with passwordless login. I was expecting a client certificate based authentication.
    – gAMBOOKa
    May 25, 2011 at 9:28
  • I'm confused now. Do you have SSH key based authentication working to specialsshaccount? If so, that's your "certificate based authentication." Once a user is logged in, how should they get root if it should be "passwordless?"
    – dmourati
    May 25, 2011 at 9:34
  • I was hoping for putty to be able to intercept an attempt to login as root and use the private key file for authentication.
    – gAMBOOKa
    May 25, 2011 at 9:37
  • 1
    nope, putty is out of the picture here once you successfully get a shell on your centos box. You've disabled root ssh which leaves su/sudo. Read the link above for a better understanding.
    – dmourati
    May 25, 2011 at 9:41
0

Start with adding the special account to the group: 'sudo'

%  useradd -G sudo specialsshaccount

Your system may already be configured to allow users in this group to sudo w/o password.

If not place this line in your /etc/sudoers (via visudo command)

%sudo ALL=NOPASSWD: ALL

protip: it's possible to allow only certain commands to execute without password (man sudoers)

Improve this answer
1
  • your sudoers line needs to start with %
    – dmourati
    May 25, 2011 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .