I have read a few times to disable root login and sudo as root using another user.
But is using a public key as good if not better security?
I have read a few times to disable root login and sudo as root using another user.
But is using a public key as good if not better security?
You should absolutely disable the ability to login as root remotely, and if at all possible also only allow login authentication to occur with the use of public/private key pairs (not password-only).
Have a look through this for best-practices on how to harden SSH (although this is provided as CentOS documentation, it applies in principal to any distribution under which you run sshd as your ssh daemon).
You should disable root login for remote host, but enable it from localhost.
Here are the important lines of most of my openssh server config file:
PermitRootLogin yes # because of AllowUsers
PasswordAuthentication no # connexion allowed only with keys
AllowUsers user root@localhost
You can still connect into root by using the -A
when connecting to your server as a simple user:
local $ ssh user@server -A
server $ ssh root@localhost
su -
and enter the root password, or alternatively if your user has sudo
capability, use the command sudo su -
and enter your own password.
/etc/sudoers
file as per 'standard practices' under linux: this incorporates limiting per user/group as you seem to wish, and as for being challenged for a password, you could simply use a NOPASSWD
directive on whichever user/group(s) you wish (this is well documented but there is a relevant post here. This is also significantly lighter on the administrative side of things (to get set up), than having to copy the root privkey to all necessary users.