Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wanted to know if it's good practice / secure to allow login as root with ppk (private key) file. (no password).

This server is only for me and no one else is working on it. Thanks, Danny

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Allowing root login via ssh (even with key authentication) is never a good practice.

Even if this server is truly only for you (and only for non-critical applications), you're still setting your own habits, which you'll be tempted to employ in the future on servers that aren't just for you.

It's well worth the effort getting used to connecting as your own user and using sudo to execute commands that require elevated privileges.

share|improve this answer
    
got it :) 1 thing i could never understand is, why sudo if i'm the only user....having to add sudo before each command is annoying... –  Danny Valariola May 25 '13 at 17:36
1  
Traceability, logging of commands, one more roadblock to prevent you from shooting yourself in the foot. –  EEAA May 25 '13 at 18:06
    
Even logging in as simple user then doing su - is better than nothing in case of multiple people with root password. At least you'll have the user's name who switched to root in audit.log. And I agree with you that adding sudo on every line is annoying. I'd say it's more for one-off commands. I.e. if you're installing a new service (e.g. dhcp) on the server and will be doing a bunch of vim, less, tcpdump, service commands one after the other su - seems more natural. You just need to take care not to use it for everything (e.g. ssh to another server, wget, ...). –  skara May 26 '13 at 9:34

As mentioned above allowing root login is never good. Once you are logged in as a different user you can use su - and then enter the password to "login" as root (get roots shell) or you can also use su - username to login as another user. You lose, however, the auditing capabilities of sudo.

share|improve this answer

Best practice would be not to allow root login, and if it does need to be allowed (for say, rsyncing backups), the it should be allowed with keys only, and with forcecommand.

share|improve this answer
    
Hi @Cian...can you explain forcecommand? –  Danny Valariola May 26 '13 at 20:08
    
ssh forcecommand lets you ignore what a user wants to do, and run a pre-specified command. That means you can have root login, and be forced to run something like rsync to do backups. –  Cian May 27 '13 at 10:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.