3 ms·

What do you think proper architecture would be, given that ssh needs a capability to let root logins? I suppose it could be via a proper PAM module, which is w

by nine_k 9mo ago

What do you think proper architecture would be, given that ssh needs a capability to let root logins? I suppose it could be via a proper PAM module, which is widely supported. Too bad the first PAM RFC was published about the same time the first be version of ssh was released.

accrual 9mo ago
> ssh needs a capability to let root logins One can disable root login via SSH in /etc/ssh/sshd_config. sshd also drops root priviledges once it's running IIRC. I use use sudo or doas as a regular user once logged in.
charcircuit 9mo ago
I think a proper architecture would not even have a root account. The server would just expose an authenticated endpoint that allows for configuration and updates to be pushed for it.
- nine_k 9mo ago
  You are thinking 20 years ahead. In 1995 most servers were still pets, not cattle.
spott 9mo ago
Does ssh need to allow root logins? Sshing as a regular user and then sudo to root works 95% of the time…
- jmb99 9mo ago
  How does SSH become an arbitrary user without effective root?
  - nine_k 9mo ago
    SSH should not become a different user; it should call something like `/bin/login` which uses PAM for authentication and is capable of starting user sessions.