I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines.
One of these guidelines suggests to disable root user and create a new user that works as an administrator using sudo. Another of these guidelines suggests to disable ssh authentication through user and password and enable the public key authentication.
I followed both the suggestions and now I find myself using the new administrator account on the server but needing to input the password for that user each time I need to execute administrative commands (sudo asks for it).
The question is: is this really the way everything should work (according to security guidelines)?
I mean: the vulnerability of the password used for ssh authentication is different from the vulnerability of the (same) password used to execute sudo "inside" an opened session?