Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need to configure a machine so software installation can be automated remotely via SSH. Following the wiki, I was able to setup SSH keys so my user can access the machine without a password, but I still need to manually enter my password when I use sudo, which obviously an automated process shouldn't have to do.

Although my /etc/ssh/sshd_config has PermitRootLogin yes, I can't seem to be able to login as root, presumably because it's not a "real" account with a separate password.

How do I configure SSH keys, so a process can remotely login as root on Ubuntu?

share|improve this question
2  
If you automate installation from a central machine, you can limit the scope of the key so it will only be accepted from the given host. Simply prefix the line in authorized_keys with from="host.ip.goes.here" ssh-rsa [...] –  Egil Mar 23 '12 at 10:03

3 Answers 3

up vote 15 down vote accepted

EDIT: As alluded to in the comments, although directly answering the question, this answer does leave you open to calculated risk. Ubuntu locks down root access and adds sudo as a way to accomplish admin tasks for a reason.

Answering the Question

So, you want to login AS root via ssh so that you can run an update script.

You need to add your key to the root authorized_keys file on the server.

On the Server

  1. sudo su - root
  2. ssh-keygen (to make sure root has the .ssh directory etc)
  3. add your public key to .ssh/authorized_keys
  4. check your sshd_config settings are correct one last time.

    PermitRootLogin yes

    RSAAuthentication yes

    PubkeyAuthentication yes

  5. Ensure those settings take effect by restart ssh: service ssh restart

On the Client

  1. Login to the server as root using: ssh root@yourserveraddress

Note: If this doesn't work you'll need to do some further investigations.. Try posting the results of an ssh -v root@yourserveraddress.

Recommended alternative approach

For security reasons the above approach, although answering the question, should not really be used as it opens up the root account to login. Although key based authentication is vastly more secure than passwords, it's still better practice to disallow any form of root login through ssh.

A better approach is to create a user with limited scope password-less sudo commands and add key based ssh access to that user, as alluded to in other peoples answers.

share|improve this answer
2  
As a note though.... please disable PasswordAuthentication in sshd at the very least to lock things down a bit. Otherwise your root account is still vulnerable to password attempts... not good –  Ashimema Mar 23 '12 at 9:21
    
-1 Every time you give instructions on how to do something dangerous, you must give warning as to why it is dangerous, and when possible show a better way. See discussion on meta.askubuntu.com/q/1409/6161 –  David Oneill Mar 23 '12 at 17:08
    
@DavidOneill: that is true, but I think the answer is still a good one. Does it really deserve to be downvoted? –  Jo-Erlend Schinstad Mar 23 '12 at 21:17
    
@DavidOneill Comment is fair as it enlightened me to further information on meta.. I'm relatively new here so thanks.. I'll add warning to my answer as requested. Thanks for the support though Jo-Erlend Schinstad –  Ashimema Mar 23 '12 at 23:22
    
I removed my -1 now that there is a warning. Thanks for adding that! :) –  David Oneill Mar 25 '12 at 14:09

You are confusing two different things:

passwordless log is used to make sure that people can't log into your system remotely by guessing your password. If you can ssh username@machine and connect without a password, this is set up correctly, and has nothing else to do with this.

sudo is used to permit a normal user account to do something with super user permissions. This does require the user to type their password. This happens whether you are connected remotely (via passwordless or password-protected SSH) or are local on the machine. You are trying to set sudo to not ask for your password, which is not recommended, but you can learn how to do that via an answer like http://askubuntu.com/a/74083/6161

Note to future readers of this answer:

My above answer does not answer the original poster's actual question, it describes what you should do instead. If you really want to allow remote connections directly to the root account, you need to enable the root account (see my comment below). Again, let me say DO NOT allow remote remote log-ins to your root account.

share|improve this answer
    
You're misunderstanding me. I know the difference between SSH and sudo. The problem is that I'm unable to ssh using root@machine. Using my "normal" account and adding it to my sudoers file would accomplish the same thing, but I was trying to do it solely through SSH. This is possible in Redhat based distros. I take your answer to mean this is not possible in Debian based distros. –  Cerin Mar 22 '12 at 19:58
    
@Cerin Ah - you want to enable root log-in askubuntu.com/q/44418/6161 Again, this is almost always a bad idea, especially when you're allowing external connections. But, the link in the comment describes how to do it. –  David Oneill Mar 22 '12 at 20:40
    
Thanks. Since my goal is automated software installation, does it matter whether I add a non-root user to sudoers, or allow root log-in? There both potential security concerns, but one of them is necessary. –  Cerin Mar 23 '12 at 0:22
1  
sudo provides more fine-grained control. For instance, you could allow the non-root user to run apt as root without giving a password, but not arbitrary commands. Since your goal is automated software installation, you should use the least privileged solution to your goal. –  Egil Mar 23 '12 at 9:54
    
@Cerin Yes, it does matter. Beyond what Egil pointed out, askubuntu.com/q/16178/6161 is a whole discussion of why logging in a root is a bad idea. –  David Oneill Mar 23 '12 at 17:04

PermitRootLogin controls whether the user named "root" (to be precise: any user with UID 0) is allowed to login. If you're logging as root, you do not need sudo to perform privileged tasks.

On the other hand, if you to login on a user account and use sudo without a password, you must configure the sudoers file without having to fiddle with /etc/ssh/sshd_config. See How to make Ubuntu remember forever the password after the first time

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.