Tag Info

Hot answers tagged

6

My thoughts: Set PasswordAuthentication and PermitRootLogin to no Optionally, passphrase your SSH keys (though there's no way to enforce this) Use MFA as Tim's answer suggests to further restrict SSH access (personally, I'd do this via PAM's Google Authenticator plugin) Do not enable passwordless sudo, and ensure strong passwords are set for your users. ...


5

So far I have disabled PermitRootLogin on SSH and switched the port. I'm not a big fan of running services on non-standard ports; you make interopability harder for yourself and others, for no real gain. With a decent password (or better: key), random SSH scans have no chance of succeeding anyway, and targeted attacks are not phased by a different port. ...


3

I'm assuming the only reason you can't just directly connect via ssh to ferguson as the user admin is simply because either no password is set for admin or you just simply don't know it. There could be other reasons for this not working, such as no login shell. The best solution for this is to use SSH keys. On your Linux VM, if you haven't already, ...


2

I propose to put the command into a shell script and just give sudo rights for this script. Just make sure the users aren't allowed to edit it.


2

What we do (ops company) is disable password logins and only allow keys. Use a cryptostick (new name, NitroKey) or just a smartcard, but that means you'll also need a reader along. This way you have two-factor authentication, something you have (the stick or card) and something you know (the password for sudo). Do not ever switch to root unless you really ...


1

Based on this gist, I've made a concise and clean version: # Prevent sudo timeout sudo -v # ask for sudo password up-front while true; do # Update user's timestamp without running a command sudo -nv; sleep 1m # Exit when the parent process is not running any more. In fact this loop # would be killed anyway after being an orphan(when the parent ...


1

You'll need to do an offline recovery. The steps are roughly: Shut down the server. Start up another temporary instance. Detach the EBS disk from the original server and attach it to the temporary server. Mount the filesystem. Edit /etc/shadow and copy/paste a known password hash into the ec2-user's entry. Unmount and detach from temporary server. ...



Only top voted, non community-wiki answers of a minimum length are eligible