For added security, we've disabled root login to server via ssh. We have a special ssh account that users need to login as, and then su as root in they require root access.

How can we setup passwordless logins using putty in this situation? I've setup passwordless login to the special ssh account, but we still need a password when we su as root.

If I'm not clear, feel free to ask me to clarify.

  • What OS are you using? – Bart De Vos May 25 '11 at 9:22
  • centos 5 (more char filler) – gAMBOOKa May 25 '11 at 9:29

You could also change in your sshd configuration file the following line :

PermitRootLogin without-password

This will allow users to login as root but only using something else than password (kerberos tickets, ssh keys etc...)


Edit /etc/sudoers via the visudo command.


specialsshaccount       ALL=(ALL)       NOPASSWD: ALL

Tip: http://www.sans.org/reading_room/whitepapers/basics/administration-shared-accounts_1271

  • I'm not very comfortable with this. This is not what I meant with passwordless login. I was expecting a client certificate based authentication. – gAMBOOKa May 25 '11 at 9:28
  • I'm confused now. Do you have SSH key based authentication working to specialsshaccount? If so, that's your "certificate based authentication." Once a user is logged in, how should they get root if it should be "passwordless?" – dmourati May 25 '11 at 9:34
  • I was hoping for putty to be able to intercept an attempt to login as root and use the private key file for authentication. – gAMBOOKa May 25 '11 at 9:37
  • 1
    nope, putty is out of the picture here once you successfully get a shell on your centos box. You've disabled root ssh which leaves su/sudo. Read the link above for a better understanding. – dmourati May 25 '11 at 9:41

Start with adding the special account to the group: 'sudo'

%  useradd -G sudo specialsshaccount

Your system may already be configured to allow users in this group to sudo w/o password.

If not place this line in your /etc/sudoers (via visudo command)


protip: it's possible to allow only certain commands to execute without password (man sudoers)

  • your sudoers line needs to start with % – dmourati May 25 '11 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.