3 ms·
SSH with public/private key pair or certificate authentication and sudo (optionally with pam_ssh_agent_auth[0]). This of course means you have to have access t
by aequitas 6y ago
SSH with public/private key pair or certificate authentication and sudo (optionally with pam_ssh_agent_auth[0]). This of course means you have to have access to the node first before you can do anything with SSH. Which most often is the case if you roll your own base images in cloud environments or use something like cloud-init.
[0] http://pamsshagentauth.sourceforge.net/ http://pamsshagentauth.sourceforge.net/
- wcchandler 6y agoJust curious, what was your rationale for using pam ssh agent auth over nopasswd? It definitely looks more secure as it’d prevent our sudoers from sudoing into our ansible account but that’s about it. We have local console access disabled for the ansible account.
- aequitas 6y agoThe SSH key you use for sudo can be different than the one you use for accessing the machine, though I never used it that way. When I first used this setup I tried to build a server configuration that itself was completely open source[0]. So there was no way to bring secrets (like a root or sudo password) to the machine as everything had to come from the source repository so I had to rely on asymmetric authentication. [0] https://gitlab.com/internet-cleanup-foundation/server https://gitlab.com/internet-cleanup-foundation/server