3

I'm setting up a fresh Ubuntu 13.04 server. I created some users and copied their public keys for ssh authentication to their home folders. Login via password will be disabled. Everything works fine so far, but if I login via ssh + private key, I'm not able to sudo. I have to enter a password, but all passwords are empty.

I found several hints how to change /etc/sudoers, but also a lot of warnings not to edit the file manually. So my question is:

  • Is it secure to just use public/private key authentication without password?
  • What's the correct way to configure this behaviour?
Improve this question
1

2 Answers 2

Reset to default
3

You're really talking about two different things. Configuring SSH to do key based authentication only is part of the sshd config, and sudo (passwordless or no) is handled by pam. What you should really be doing is this:

Configure SSHD to Only Allow SSH Key Authentication

Edit your /etc/ssh/sshd_config to modify and/or add as necessary the following

PubkeyAuthentication yes
PasswordAuthentication no

Then restart the sshd service.

Configuring sudo

You'll want to pick your sudo group and modify the sudoers file, using the visudo command and add something like this.

%wheel   ALL=(ALL)       ALL

That will allow everyone in the wheel group to execute any command as any user. Note that they will need to enter a password to do this. By default most distributions have them enter their own password, but sometimes sudo is configured to have them enter the target password.

Alternatively, you can configure sudo to not ask for a password at all. I don't recommend this except in the case of automated actions carried out by service accounts. In that situation you can specify only the service account can execute only a specific command. However, you're more than capable of removing the sudo password requirement by changing the above line to something like:

%wheel  ALL=(ALL)  NOPASSWD: ALL
Improve this answer
0

Why the passwords are empty ? You could disable the password authentication in SSH, and keep passwords to go in sudo. To disable password authentication in SSH, edit /etc/ssh/sshd_config and activate PasswordAuthentication no

The key exchange is far more secure than password : there is 2048 bytes to found in place of 5-10 chars...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .