2

I'm aware that allowing root access to a server over SSH is a bad idea (i.e. allowing login as root over SSH). But how about the other end of the equation? Are there any downsides of initiating a SSH connection from a client machine where I am logged in as root? So, something like:

root@localhost$ ssh unprivileged-user@remoteserver.tld

Would this have any security implications for the client machine (localhost in this example)?

More background: On a local machine in my home network (not reachable over the internet) I have a small service that collects information from the machine itself as well as some limited information from remote servers over SSH. The service itself runs as root due to the information it gathers on the local machine. On the remote servers it uses non-root logins with access only to the information it's set up to collect. Now I'm wondering if there is any benefit if the service is dropping the root privileges when establishing the SSH connections to the remote servers (e.g. via runuser) or if it doesn't matter at all and the local server might just as well initiate the SSH connections as root on the local machine.

Thanks!

Improve this question
  • 2
    There have been a handful of ssh client vulnerabilities that, if exploited, could be much more damaging if the client is running as root than if it were running as an un-privileged user. I can't think of any other reasons, though, other than the general distaste for doing anything as root unless you absolutely must. – EEAA Feb 13 '17 at 22:56
1

The root info gathering process(es) could write the files to some directory that a not-root service account can then copy elsewhere. This may require rename(2) or equivalent so the service account doesn't copy a half-written file (or maybe it is desirable to transfer partially collect data?). Benefits:

  • As @EEAA pointed out, SSH client vulnerabilities don't get root.
  • A service account cannot wipe out /etc/passwd or all of /var or whatever if there's a whoopsie in the service account file transfer related code. Sure it could kill it's own home directory, but that's a far smaller issue than what root has access to. (Or whatever a fumble-fingered admin is doing as the service account vs. full root access...was that the production database I just...)
  • Knowing how to setup and use service accounts is probably good to know.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.