4

As it is well known, it is recommended that the system administrator login to the system using a normal user (non-root). When the admin needs to do privileged tasks, sudo can be used to become superuser. Before gaining the requested privileges, the admin will be prompted to enter the SAME password used in the first login.

I was wondering whether it is possible to configure the system to ask the user for a different password when doing sudo. So, the user will have two passwords. The first password will provide access to SSH session. The other password (not the same one) will be used to gain the admin (root) privileges.

Is this possible? I think it will add more security to the system. Do you agree?

BTW, this will be similar to the access control used by Cisco devices. First, the admin login using a password. Then, accessing "enabled" (privileged) mode requires another password (can be different or same password).

Improve this question

2 Answers 2

Reset to default
8

SSH via a password is less secure than SSH with a DSA/RSA certificate. Create a certificate with a password. Then give the sys admin account a different password.

You will only be able to login via SSH if you have the certificate AND know the password associated with it.

You can then use a different password for running sudo (the user's password).

This gives you a lot more security!

Remember to use pass phrases and not passwords too. The difference being a pass phrase is made up of many words (greater than 20 characters say). The longer the password, the more time it would take to break via dictionary attacks.

To create a certificate:

  • type ssh-keygen at a terminal and follow the instructions (giving a unique filename and enter your pass phrase)
  • then copy the public key onto the server you are administering using ssh-copy-id -i path/to/your/sshkey.pub
  • Now log on to your server and turn off password authentication in /etc/ssh/sshd_config and restart the sshd service
Improve this answer
5
  • Thanks for the info! I know about login using certificates, but suppose I still want to login using passwords.
    – Khaled
    Nov 28, 2010 at 14:11
  • Actually shorter random passwords should be preferred to longer pass phrases (check out manpages.ubuntu.com/manpages/maverick/man1/apg.1.html for a password generation tool). Otherwise good answer, nothing to add.
    – hudolejev
    Nov 28, 2010 at 14:12
  • Using certificates login is a good way to secure SSH server. However, I think it will be harder to login when you have many servers and you may login from different machines. For example, I need to login from my administration PC in addition to login from several other servers.
    – Khaled
    Nov 28, 2010 at 14:23
  • Why should shorter passwords be preferred? Sequential password files (like the ones you can generate w. Crunch) would take less time to crack a shorter password. Random passwords only avoid dictionary attacks. I'm not strictly recommending this, but if having many servers is a reason you are not going to use certificates, then just use the same certificate for many machines! Copy the public key using ssh-copy-id. If you had a list of servers in a file, it would be a one-liner from bash to install them! Or you could use a certificate for groups of machines which have the same security level.
    – tommed
    Nov 29, 2010 at 12:42
  • Just because of dictionary attacks. For a proper passwords, say, longer than 8 characters, brute-force attacks are not sensible anyway (here I mean all letters-numbers-special-chars, dictionary size 60..70). Thus, longer passwords only mean a greater chance to make a typo, and decreasing the crack time from thousand to hundred years is not the most desired goal I guess. Of course I agree that proper pass phrase will work too, but this is sooo offtopic (:
    – hudolejev
    Nov 30, 2010 at 16:44
0

You might want to look towards using su root instead of sudo, but I strongly recommend to follow the answer tommed has provided.

Improve this answer
1
  • Is this really your answer?
    – Magpie
    Jan 14, 2013 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .