6 ms·
The goal is to avoid password sharing. if 20 people have root password, and server supports root login, then you can't know which of the 20 people had their ma
by adamzochowski 5y ago
The goal is to avoid password sharing.
if 20 people have root password, and server supports root login, then you can't know which of the 20 people had their machines compromised.
if 20 people each have to sudo, then you can trace which user was compromised.
- AviationAtom 5y agoIf all users have a unique key for root access, and only keyed authentication is possible, then you can match the key fingerprint in the logs to a physical user.
- rkeene2 5y agoI typically frame this as accounts are for accountability. Reducing accountability isn't typically a goal for organizations so it's strictly better to have 20 accounts with sudo versus everyone using a single shared account (shared accountability) UNLESS the accountability is managed some other way (I think this something Gravitational Teleport tries to sell on this forum often).
- noinsight 5y agoYou can use smart cards as plain SSH keypairs and sshd will of course log the fingerprint of the key used to authenticate. That's pretty foolproof accountability.
- rkeene2 5y agoI in fact have done this (heavy user of smart cards and author of middleware), BUT what sshd logs (a fingerprint of the public key) requires a bit of work to match an authorized_keys format file (basically a stripped down PKCS#1 format with a header). I actually use a fork of OpenSSH called PKIXSSH which supports X.509 certificates in sshd, and this is far more reliable.
- croutonwagon 5y agoAlso, at least in Ubuntu, sudo commands are logged in syslog and are thus auditable. That’s not necessarily the case if you su as root and run the same commands.
- miohtama 5y agoA stronger solution to enable two-factor authentication, so that a machine compromise does not compromise SSH access.
- remram 5y agoTurning this on its head, about password sharing. If 20 people have the root password, there is a single password that will allow your machine to be pwned. If 20 people have 20 passwords and sudo access, then any of 20 passwords will allow your machine to be pwned. You can't know which of the 20 people you're trusting to pick a password is reusing it.