I love the idea of accessing servers via keys, so that I don't have to type in my password every time I
ssh into a box, I even lock my user's (not
root) password (
passwd -l username) so it's impossible to log in without a key.
But all of this breaks if I'm required to enter password for
sudo commands. So I'm tempted to set up passwordless
sudo to make things in line with passwordless login.
However, I keep having a gut feeling that it may backfire at me in some unexpected way, it just seems somehow insecure. Are there any caveats with such set up? Would you recommend/not recommend doing this for a user account on a server?
- I'm talking about the use of
sudoin an interactive user session here, not for services or administrative scripts
- I'm talking about using a cloud server (so I have no physical local access to a machine and can only log in remotely)
- I know that
sudohas a timeout during which I don't have to re-enter my password. But my concert isn't really about wasting the extra time to physically type in a password. My idea though was to not have to deal with a password at all, because I assume that:
- If I have to memorize it at all, it's very likely too short to be secure or reused
- If I generate a long and unique password for my remote account, I'll have to store it somewhere (a local password manager program or a cloud service) and fetch it every time I want to use
sudo. I hoped I could avoid that.
So with this question I wanted to better understand the risks, caveats and tradeoffs of one possible configuration over the others.
Follow up 1
All answers say that passwordless
sudo is insecure as it allows "easy" escalation of privileges if my personal user account gets compromised. I understand that. But on the other hand, if I use a password, we incur all the classic risks with passwords (too short or common string, repeated across different services, etc.). But I guess that if I disable password authentication in
/etc/ssh/sshd_config so that you still have to have a key to log in, I can use a simpler password just for
sudo that's easier to type in? Is that a valid strategy?
Follow up 2
If I also have a key to log in as
root via ssh, if somebody gets access to my computer and steal my keys (they're still protected by OS' keyring password though!), they might as well get a direct access to the
root account, bypassing the
sudo path. What should be the policy for accessing the
root account then?