3 ms·
I agree that this move is good. But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin accou
by ghighi7878 7mo ago
I agree that this move is good.
But you should not type sudo passwords on remote machine. Instead setup your machinr to have nopassword for special sdmin account and enable pubkey only authentication.
- written-beyond 7mo agoYeah but am I going to really open another ssh connection just to run an admin specific command. They also didn't provide an admin user, it setup with all of the extra security configurations. You couldn't even `su`
- ghighi7878 7mo agoI mean nopasswd option of sudo
- wolvoleo 7mo agoWith sudo you can also give people specific access to commands. I personally use the pam ssh agent module for this, that way you can use agent forwarding with sudo.
- ghighi7878 7mo agoI did mean nopasswd option of sudo.
- Wowfunhappy 7mo agoWhy is it better to have a nopassword admin account when using a machine remotely? The point of SSH is to resist mitm attacks, right? If someone could watch my keystrokes, I think I'd have bigger problems!
- tsimionescu 7mo agoThis resists scenarios where the machine you are running SSH from is compromised, and has a keylogger or something similar installed. SSH can't protect you from a local attacker (in fact, the SSH client binary itself could be the compromised part).
- __david__ 7mo agoYes, but if the server you’re logging into only accepts keys then leaking its password isn’t nearly as bad. Though I guess if your local ssh client is compromised then your local private keys are also compromised so you’d be screwed anyway (unless you are using a yubikey type of thing—I should get me one of those).
- Wowfunhappy 7mo agoIf I own both machines this doesn't seem entirely reasonable. (Of course a machine I own could be compromised but again, then I have other problems.)
- deleted 7mo ago[deleted]
- trvz 7mo agoReal men rawdog with root.