I am not asking how to do anything here, rather trying to understand best practices and the "right" way to handle server security. To prevent brute force password attacks, I have secured my server in a number of ways, one of which being password protected SSH Keys for login on any user (right now it is a single developer box). Obviously any time a user needs to login he will need access to both the key and the password for that key.
However, I am trying to understand how I should handle a system password for that (or any) particular user, specifically when dealing with sudo. A few questions:
- is there value in giving each user a password at all (so he/she can use sudo)?
- if so, is it overkill to use an insanely secure password for such (i.e. 384 bits+)
- assuming the answer above is no:
- How could any user remember this password every time they need to run a sudo command (yes lastpass, dashlane, 1pass, etc are options but having to open/authenticate/find and copy that really long password seems like a huge pain the ass).
- What is secure enough for these passwords and does it matter if dictionary attacks would find the sudo password in 3 seconds anyway?
Thank you ahead of time!