1

I've managed to disable PermitRootLogin in my sshd_config file for security reasons. My new user is in the sudoers file, but every time I have to use the sudo bash command I must enter my password if I want to do installing and other system stuff.

Is it possible to automatically enter or disable entering a root password and still be root as my new user?

6
  • 6
    You can. You can also jump in front of a train. Neither is recommended.
    – Hennes
    Mar 2, 2014 at 14:55
  • I think I should point out that @tamani is referring to not getting a password prompt in sudoers, although the question title does a terrible job of explaining this. Mar 2, 2014 at 15:00
  • 2
    You should never work as root (e.g. su - or sudo bash). You will blow something up eventually. All it takes is time. Be judicious in your use of sudo, that's why it exists -- to make you think for a second before you execute something and to protect you from accidentally issuing commands that can put your system in an unrecoverable state. Mar 2, 2014 at 16:03
  • Yes, it is a good practice to not allow interactive root ssh session, and yes, it can be useful to not prompt for password at sudo, and no, all the judgmental "you should never do that" comments are neither constructive, nor helpful, they are offensive and off-topic.
    – Olivier S
    Mar 2, 2014 at 17:23
  • @Olivier I wouldn't go as far as calling comments that are trying to explain good security practices offensive. Yes, they may be evangelical to a degree, but best practices are there for a reason, and good security costs nothing. In professional systems administration, practices like using password prompts for sudo are your ally, not your enemy. I've seen far too many corners cut (many of them in production systems) at the risk of security to not hold this view. Mar 2, 2014 at 17:51

3 Answers 3

5

Try

user    ALL=(ALL) NOPASSWD:    ALL
2

In short: no. This is exactly the situation that root/sudo protects against. Entering your user's password is an extra security measure.

You can get around the password restriction by using the NOPASSWD option in /etc/sudoers but this should only be used in exceptional circumstances.

Reference: http://www.ducea.com/2006/06/18/linux-tips-password-usage-in-sudo-passwd-nopasswd/

4
  • 1
    Why should it be "exceptional"? There are many use cases where it is perfectly desirable to not prompt for password.
    – Olivier S
    Mar 2, 2014 at 17:17
  • Any security measure should never be disabled unless you have a good reason, and the sudo password prompt is one such measure. It's exactly the same as disabling UAC on a Windows box. The only acceptable use-case that I can think of is when you want to run an automated command remotely that requires elevation (e.g. Nagios check over NRPE). Laziness and "it's annoying" are not valid use-cases to disable UAC or the sudo password prompt. Mar 2, 2014 at 17:42
  • uac on windows has many good reasons to be disabled. Your comment just shows you were not confronted to situations where UAC just breaks production systems. Also I have seen very few situations where UAC did actually increase the level of security. Security is not a collection of tweaks. Security is a process. It has to be adapted to utilisation cases.
    – Olivier S
    Mar 2, 2014 at 18:03
  • UAC doesn't break production systems. It merely highlights poorly written software. Mar 19, 2014 at 3:33
1

Craig Watson is absolutely right!

While some people insist that working as non-root adds security I tend to oppose this at least under some circumstances! But this depends a lot on what you're doing on the machine...

A desktop user regularly does NOT require root privs and it's really dangerous to work with elevated rights as there are many attack vectors that might be exploitable more easily.

On a (web)server it depends: are you just doing dev-work like uploading apps/coding things or doing administrative stuff? In the first case you probably don't need root permissions, too!

While on a KVM host 95% of the tasks require root privs so using an unpriv user is nothing but complicated. Here it's usually enough to tighten general server security. On such systems I rather suggest disabling password-auth (at the very least for root) e.g. by setting

PermitRootLogin without-password

or add a PAM based solution instead of following the multi-user approach. I've seen a lot of systems where direct root login was disabled for "security" reasons and instead people used a 8 char password for the wheel group user admin.

As long as you lock down root properly it does not pose a significant security risk.

Here are some suggestions (incomplete)

  • password requirement for single user mode
  • set a looong root password (but skip certain special chars when using a IPMI/DRAC card for remote access)
  • disallow pasword-based root logins
  • limit root logins to certain IPs/a managment network
  • limit the availability of (managment) services to certain IPs/a managment network
  • double check the services you expose to the network and only allow those that are required and properly secured.

EDIT

@ Olivier S

I've managed to disable PermitRootLogin in my sshd_config for security reasons.

The OP mentioned this and while he is asking how to disable the sudo password promt this is all related to security! Besides that I did not focus on SSH nor did I say it's always a bad idea to use sudo without password. Nevertheless while the question has already been answered people should still be made aware of the consequences.

Just because it's common practice to do something the way X you always have to question how that way does perform in the specific situation.

The result in this specific case is that the OP is using an unpriv-account due to security reasons. Now the password promt annoys him so he wants it to be disabled. The result will be that the machine is at least as insecure as if he would be working as root directly!

In fact it makes sense to use sudo without password for certain jobs but then you should always limit that to a specific set of commands or use a secure wrapper-script!

1
  • The question was about sudo, not ssh. And it was about a feature, not a general policy.
    – Olivier S
    Mar 2, 2014 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .