SSH and security guidelines

Question

I'm trying to set-up an ubuntu server (14.04 LTS) following some security guidelines.

One of these guidelines suggests to disable root user and create a new user that works as an administrator using sudo. Another of these guidelines suggests to disable ssh authentication through user and password and enable the public key authentication.

I followed both the suggestions and now I find myself using the new administrator account on the server but needing to input the password for that user each time I need to execute administrative commands (sudo asks for it).

The question is: is this really the way everything should work (according to security guidelines)?

I mean: the vulnerability of the password used for ssh authentication is different from the vulnerability of the (same) password used to execute sudo "inside" an opened session?

Answer 1

No one has actually addressed your question yet.

Disabling a password for sudo commands isn't much of a security risk, especially if you're using key-only SSH login. To do this, run:

sudo visudo

And edit the "sudo" group line to be as follows:

%sudo  ALL=(ALL:ALL) NOPASSWD: ALL

The NOPASSWD is the key. With this you will no longer be asked for a password when running commands with sudo.

Answer 2

Yes, this is indeed a common practice.

Using sudo instead of working as root is primarily about protecting you from yourself - if you have to sudo to do some dangerous thing, you are more likely to pay attention.

About using it with SSH keys:

Disabling password based login effectively prevents any brute force attempt to login to a SSH server by simply trying lots of passwords for common accounts (like root). You need the private key file to login this way. This is much more secure than allowing password login.

This layer of security is added to the security of your password for sudo, as you can only use it after you logged in to the machine via SSH with your private key file.

Answer 3

Yes, this is a common practice. It is a common practice because if ssh is disabled for root an attacker has to guess the username which has access to the server.

If you want to avoid typing in the password you have several options:

• login to root shell by sudo bash
• tweaking the timeout value in the sudoer file.

open the sudoers file:

sudo visudo

and change the value of Default timestamp_timeout to a more comfortable value.

Default timestamp_timeout=30

With this value sudo remember your password for 30 minutes.

There are several other things you could change in your sudoers file. I recommend reading this blog post.