1

I have worked in places where it is a common practice to be able to move between all servers, with SSH, as administrator without passwords. There are usually a couple of servers, which by their nature are considered more secure (not exposed on the web, etc) from where you can login to others without password. The opposite has also happened - you need passwords/other access control mechanisms for everything.

I have very strong objections against the first formula from a security perspective. Although this group of servers can be considered more secure, this is obviously debatable. But I have several coleagues that advocate this, and I have to admit it's very handy. In any case if an attacker can get root privileges in one machine it basically "owns" the full system.

Am I being too strict regarding security?

2
  • 4
    very simple: its not a good idea at all. compromise 1 host and expose your entire infrastructure at administrative level. Nov 16, 2015 at 16:48
  • You should ask on security.stackexchange.com instead
    – Jim B
    Nov 16, 2015 at 23:25

1 Answer 1

5

It depends somewhat on the environment. A firewalled, and ACL'd environment without direct internet access, such as an HPC compute farm could certainly use this type of practice for ease of use. I've seen this used to great effect in chip-design environments that have large numbers of nodes and a fairly small administrative cadre. It allows superior flexibility and quick response when issues need to be addressed across the entire compute cluster.

Another environment I've seen in use was to allow key-based root SSH from a set of defined hosts (bastion hosts) that were very heavily protected and monitored. The mechanism to allow key use was to have an ssh-key passphrase and an ssh-agent running for the root user on these bastion hosts. Destination hosts were configured to allow root ssh only from those hosts with that specific key. Authenticate up to the super-user level and enter the passphrase for the key to load it into the agent. Then you're off to the races.

So it can be done, safely. You just have to choose what and where you are going to allow exposure.

3
  • The second situation is roughly what I had before. I should probably clear that on the question.
    – nsn
    Nov 16, 2015 at 18:09
  • I would add that while these avenues did exist, they weren't in use very often. Most of the work we needed to do was easily accomplished using regular user logins and sudo to escalate privileges.
    – Thomas N
    Nov 16, 2015 at 18:58
  • Yes, I understand. But the previous setup that I describe was also used to collect data from the several servers. Although I didnt like it much itś hard to replace since it had a couple of years of work and things building up.
    – nsn
    Nov 16, 2015 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .