3 ms·
Just curious, what was your rationale for using pam ssh agent auth over nopasswd? It definitely looks more secure as it’d prevent our sudoers from sudoing into
by wcchandler 6y ago
Just curious, what was your rationale for using pam ssh agent auth over nopasswd? It definitely looks more secure as it’d prevent our sudoers from sudoing into our ansible account but that’s about it. We have local console access disabled for the ansible account.
- aequitas 6y agoThe SSH key you use for sudo can be different than the one you use for accessing the machine, though I never used it that way. When I first used this setup I tried to build a server configuration that itself was completely open source[0]. So there was no way to bring secrets (like a root or sudo password) to the machine as everything had to come from the source repository so I had to rely on asymmetric authentication. [0] https://gitlab.com/internet-cleanup-foundation/server https://gitlab.com/internet-cleanup-foundation/server