Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've managed to disable PermitRootLogin in my sshd_config file for security reasons. My new user is in the sudoers file, but every time I have to use the sudo bash command I must enter my password if I want to do installing and other system stuff.

Is it possible to automatically enter or disable entering a root password and still be root as my new user?

share|improve this question
6  
You can. You can also jump in front of a train. Neither is recommended. –  Hennes Mar 2 at 14:55
    
I think I should point out that @tamani is referring to not getting a password prompt in sudoers, although the question title does a terrible job of explaining this. –  Matthew Ife Mar 2 at 15:00
2  
You should never work as root (e.g. su - or sudo bash). You will blow something up eventually. All it takes is time. Be judicious in your use of sudo, that's why it exists -- to make you think for a second before you execute something and to protect you from accidentally issuing commands that can put your system in an unrecoverable state. –  Sam Halicke Mar 2 at 16:03
    
Yes, it is a good practice to not allow interactive root ssh session, and yes, it can be useful to not prompt for password at sudo, and no, all the judgmental "you should never do that" comments are neither constructive, nor helpful, they are offensive and off-topic. –  Olivier S Mar 2 at 17:23
    
@Olivier I wouldn't go as far as calling comments that are trying to explain good security practices offensive. Yes, they may be evangelical to a degree, but best practices are there for a reason, and good security costs nothing. In professional systems administration, practices like using password prompts for sudo are your ally, not your enemy. I've seen far too many corners cut (many of them in production systems) at the risk of security to not hold this view. –  Craig Watson Mar 2 at 17:51

3 Answers 3

Try

user    ALL=(ALL) NOPASSWD:    ALL
share|improve this answer

In short: no. This is exactly the situation that root/sudo protects against. Entering your user's password is an extra security measure.

You can get around the password restriction by using the NOPASSWD option in /etc/sudoers but this should only be used in exceptional circumstances.

Reference: http://www.ducea.com/2006/06/18/linux-tips-password-usage-in-sudo-passwd-nopasswd/

share|improve this answer
1  
Why should it be "exceptional"? There are many use cases where it is perfectly desirable to not prompt for password. –  Olivier S Mar 2 at 17:17
    
Any security measure should never be disabled unless you have a good reason, and the sudo password prompt is one such measure. It's exactly the same as disabling UAC on a Windows box. The only acceptable use-case that I can think of is when you want to run an automated command remotely that requires elevation (e.g. Nagios check over NRPE). Laziness and "it's annoying" are not valid use-cases to disable UAC or the sudo password prompt. –  Craig Watson Mar 2 at 17:42
    
uac on windows has many good reasons to be disabled. Your comment just shows you were not confronted to situations where UAC just breaks production systems. Also I have seen very few situations where UAC did actually increase the level of security. Security is not a collection of tweaks. Security is a process. It has to be adapted to utilisation cases. –  Olivier S Mar 2 at 18:03
    
UAC doesn't break production systems. It merely highlights poorly written software. –  Ryan Bolger Mar 19 at 3:33

Craig Watson is absolutely right!

While some people insist that working as non-root adds security I tend to oppose this at least under some circumstances! But this depends a lot on what you're doing on the machine...

A desktop user regularly does NOT require root privs and it's really dangerous to work with elevated rights as there are many attack vectors that might be exploitable more easily.

On a (web)server it depends: are you just doing dev-work like uploading apps/coding things or doing administrative stuff? In the first case you probably don't need root permissions, too!

While on a KVM host 95% of the tasks require root privs so using an unpriv user is nothing but complicated. Here it's usually enough to tighten general server security. On such systems I rather suggest disabling password-auth (at the very least for root) e.g. by setting

PermitRootLogin without-password

or add a PAM based solution instead of following the multi-user approach. I've seen a lot of systems where direct root login was disabled for "security" reasons and instead people used a 8 char password for the wheel group user admin.

As long as you lock down root properly it does not pose a significant security risk.

Here are some suggestions (incomplete)

  • password requirement for single user mode
  • set a looong root password (but skip certain special chars when using a IPMI/DRAC card for remote access)
  • disallow pasword-based root logins
  • limit root logins to certain IPs/a managment network
  • limit the availability of (managment) services to certain IPs/a managment network
  • double check the services you expose to the network and only allow those that are required and properly secured.

EDIT

@ Olivier S

I've managed to disable PermitRootLogin in my sshd_config for security reasons.

The OP mentioned this and while he is asking how to disable the sudo password promt this is all related to security! Besides that I did not focus on SSH nor did I say it's always a bad idea to use sudo without password. Nevertheless while the question has already been answered people should still be made aware of the consequences.

Just because it's common practice to do something the way X you always have to question how that way does perform in the specific situation.

The result in this specific case is that the OP is using an unpriv-account due to security reasons. Now the password promt annoys him so he wants it to be disabled. The result will be that the machine is at least as insecure as if he would be working as root directly!

In fact it makes sense to use sudo without password for certain jobs but then you should always limit that to a specific set of commands or use a secure wrapper-script!

share|improve this answer
    
The question was about sudo, not ssh. And it was about a feature, not a general policy. –  Olivier S Mar 2 at 17:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.