Linux Security Cookbook [Electronic resources] نسخه متنی

Recipe 5.18 Sharing root Privileges via SSH

5.18.1 Problem

You want to share superuser
privileges with other users but not reveal the root password.

5.18.2 Solution

Append users' public keys to
~root/.ssh/authorized_keys.^{Recipe 6.4] Users may then run a root shell:}

^[1] In
older versions of OpenSSH, the file for SSH-2 protocol keys is
authorized_keys2.

$ ssh -l root localhost

or execute commands as root:

$ ssh -l root localhost ...command...

5.18.3 Discussion

As an alternative to su, you can use
ssh to assign
superuser privileges without giving
out the root password. Users connect to

localhost and authenticate by public
key. (There's no sense using password authentication
here: you'd have to give out the root password,
which is exactly what we're trying to avoid.)

This method is more flexible than using su, since
you can easily instate and revoke root privileges: simply add and
remove users' keys from
~root/.ssh/authorized_keys. However, it provides
less logging than sudo: you can learn who became
root (by log messages) but not what commands were run during the SSH
session.

Some discussion points:

• Make sure
  
  /etc/ssh/sshd_config has
  PermitRootLogin yes specified.




• ssh is built for networking, so of course you can
  extend the scope of these root privileges to remote machines the same
  way. Instead of connecting to

  localhost , users connect to the remote
  machine as root:

  $ ssh -l root remote_host




• Users can avoid passphrase prompts by running
  ssh-agent. [Recipe 6.9] This
  feature must be balanced against your security policy, however. If no
  passphrase is required for root privileges, then the
  user's terminal becomes a target for attack.




• For more security on a single machine, consider extending the method
  in this way:

  
  

  1. Run a second sshd on an arbitrary port (say 22222)
     with an alternative configuration file (sshd -f).

  
  

  2. In the alternative configuration file, set PermitRootLogin
     yes, and let the

     only method of
     authentication be PubkeyAuthentication.

  
  

  3. Disable all unneeded options in authorized_keys; in particular, use
     from="127.0.0.1" or
     from="your actual IP
     address" to prevent connections
     from other hosts to your local root account.

  
  

  4. In your firewall, block port 22222 to prevent unwanted incoming
     network connections.

  
  

  5. For convenience and abstraction, create a script that runs the
     command:

     ssh -p 22222 -l root localhost $@

  
  

5.18.4 See Also

ssh(1), sshd(8), sshd_config(5).