-2

Now that I've got your attention :)

This is more of a thought experiment than a real question

I've been thinking about using an easy root account password for recovery purposes, having in mind these restrictions for login:

  • SSH Password Authentication is off for all users
  • Only Public Key Authentication is allowed for all users
  • Users are not allowed to "su root" with root password by using eg. pam_wheel.so to prevent unauthorized users that are not in sudoers.d from becoming root
  • Only way to log in as root is via KVM / Local login
1

2 Answers 2

1

No, it's not. You are wrongly assuming, that some other layer of security is enough, i.e. it is implemented properly and will hold in any future.

There are other means for recovery purposes - either keep the passwords backed up in some external place or simply, for passwords that can be easily overruled (like may access passwords, in contrary to encryption ones) forget about them and learn how to reset when needed.

And if you do want to rely on your system-wide root account being secure, it's much better to save your complicated password in root-only readable file within root-only descendable directory, than using some easy one. Why?

If anyone could read the file, he could already be root, so no extra risk. Well, almost - he has +rx, but still no +w, but this is already huge problem.

You on the other side can always mount the filesystem from some external source and read the contents of the file.

This way you don't depend on some possible misconfigurations of PAM od sshd which might happen in the future (e.g. after the update).

Nevertheless, this is really insecure idea - especially if you can simply have the password saved securely (*pass) in your phone.

1

It depends what you call "easy".

As explained in the now classic xkcd comic strip Password Strength, passwords can be easy for humans and hard for machines, or the other way around.

My usual advice is to use easy (for humans) but long (hard for machines or bots) passwords.

So using easy but long passwords avoids the problem entirely.

Not the answer you're looking for? Browse other questions tagged .