I'd like to have some advices on my case:
I have a server with a public ip address. I have a root user with password. I have turn off (in sshd) PermitRootlogin = No
Questions/tips/advices:
How can I delete password of root and access this server with ssh without any passwords? Do I need to use only sudo with an user to get root access?
Thanks
I'll answer your questions one by one ;-).
Bevor you do anythink like that you need another user, that has all rights for sudo! On Ubuntu or Debian the user has to be in the group admin. Login with that user via ssh and try to gain root access with sudo -i. I it worked you can continue with deactivating login for root with passwd -l root and you're done.
It is possible to access server with an ssh-keypair. Thats easy and in the most cases more secure than an normal password. First you have to generate such an keypair on your Client PC. If you are using a Linux/Unix you can do this with ssh-keygen -t rsa. It is recommend to lock this keypair with a password, so only you can use them! Most Desktop-Enviroments like Gnome, Unity and Kde are able to unlock that ssh-key automatically after you unlocked your keyring/wallet.
Now you need to deploy your public key (default ~/.ssh/id_rsa.pub) on your server by adding it to the file * ~/.ssh/authorized_keys * on your server. You can do this manual or with the command ssh-copy-id user@server.
If a login with your key was successful you can do more for your security by disabling password login for ssh. To archive that you need to change the following line in the file /etc/ssh/sshd_config PasswordAuthentication yes to PasswordAuthentication no and restart the ssh-server.
No, but it is recommend! But it depends on the way you use your server. If you are the only user, that have access to your server than it is not really important what you choose, but if there are more than one user sudo make a lot more sense, because you don't have to share your root password to gain root or privileged access. If you decide, that one of the user should not have root access anymore, you only need to remove the sudo privileges instead of changing the root password and sharing it again with everybody. But not everything can be done nicely with sudo.
If you want to login directly as root without password you not need to delete root password. Instead you can set PermitRootLogin without-password in sshd config, restart sshd, generate (by ssh-keygen or puttygen.exe) key for client, copy content of .ssh/id*.pub (or export from puttygen) to ~root/.ssh/authorized_keys on server and use it to access your server as root. You can generate client keys without password (less secure) or with password but use ssh-agent/pageant.exe and it remember you password for subsequent logins.
Tuning the sshd configuration is sensitive; There's a lot of nuance that you should understand. But, basically . . .
Take your public key, you may need to generate a key pair on the system, and install it in the .ssh directory in root's home on the server. Set "PermitRootLogin yes", and then verify that when you ssh to the server it lets you in without prompting for your password. Then change the "PasswordAuthentication" setting to "no".
Beware: PasswordAuthentication=no will affect ALL connections to the system so my answer here affects everyone. You can control user by user, for example this question.
