Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

General good-practice question:

If I set up public key, passwordless authentication (say, between laptop client and desktop server... laptop may log in from home network, or out and about through the router port forwarding), is this best done for a non-superuser account? This makes sense to me, as I could always "su" into an admin account after logging in, and should someone succeed in logging in unauthorized, they would have less privileges than a superuser (I realize that the sudo password is still necessary for lots of things, even if logged in as superuser... still would rather insulate the superuser's 'user files'). Is this a good practice? Is there a good reason to log in remotely as superuser, or is it better to log in as a regular account and then "su" as needed?

Should I make a user specifically for the purpose of SSH login?

Another question: I've installed OpenSSH and edited the config to allow only a certain user, only RSA key authentication, changed default ports, etc... is there a way to ensure that the vanilla-default SSH daemon is no longer running? I'm concerned its possible to be using some awesome OpenSSH config, while the old default daemon is still accepting requests on good ol' port 22. Does installing OpenSSH sort of "disengage" the default daemon? I guess the way my router is doing port forwarding, it should disallow forwarding of port 22, but it would also be good to get each machine squared away as far as what ports its actually using (not leaving unused services/ports open).

Final question: If there are multiple machines on my home network, and I might want to SSH into more than one of them (and they are set to listen on different ports), is specifying router-ip:portnumber the only way to select between the machines (the router has one external IP)? Is this bad practice, and should I generally SSH into a "gateway machine" which then SSHs into other machines? I guess that way the router would have to only forward one port, and I could control access by specifying valid user accounts?

I'm using Ubuntu 12 and above, but I imagine the answers to these questions are not OS-dependent.

share|improve this question

closed as unclear what you're asking by Luis Alvarado Jul 10 '13 at 20:49

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
You need to ask 3 separate questions here. Please read the FAQs to understand what make a good question –  Stephen Myall Jul 10 '13 at 11:01

1 Answer 1

Please ask only one question in, um, a question.

As for the practice. If you consider the possibility that an unauthorized user logs in to your workstation, you should be aware that escalating the privileges (that is, gaining root while being a normal user on a machine) is much easier than getting access to the machine in the first place. There are many more possible exploits, holes, there is world-readable user data.

So, generally, focus on protecting your machine from unauthorized access. su and sudo still need a root or user password, respectively (unless you set up a password-less sudo).

Q2: as far as I know, openssh is the default ssh server in Ubuntu. You can always see whether port 22 is still open: try to connect to it. Or run sudo netstat -lpn --inet.

Q3 is above my "short-term memory knowledge".

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.