Is it safer to ssh as a privileged user than to ssh and sudo?

Question

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been discussed here before .

This made me wonder: should entering passwords over SSH generally be avoided? If that's the case, wouldn't it be preferable to connect as a privileged user (using a ssh key) than to connect as an unprivileged user and then successively sudo into the root account? Using the former method, no password would be transfered, while with the latter, it might be possible to guess the password. Even if ssh is configured to allow password-less login only, this could be used to read/send mails or access whatever other service is available to the user.

Is this sound reasoning? Did I get a premise wrong somewhere?

Answer 1

It is a matter of risk assessment.

On the one hand you have a speculative article where you base ephemeral information on some vague timings.

On the other hand you have the capacity to connect to ssh as a user (ideally using ssh keys), then to do a sudo (possibly without password, it depends on your specific case). You are in a highly standard environment, with best practices in place.
Even if you ssh with a password, then type a password for sudo - you are in the realms of the best practices above.

Email compromission via timing attacks is IMHO not realistic (what you get is, best case, some lengths of "stuff". With luck and specific environments you may correlate this length to passwords).

Answer 2

"connect as an unprivileged user and then successively sudo into the root account" is usually the recommended way of using UNIX systems. Many distributions are configured by default to not allow logins with root and expect users to sudo when they need root privileges. But the reason you gave is not among the main ones.

• On a system with multiple admins, you don't need to share the same root password between multiple persons, because every sudoer can have a different root password.
• On a system with multiple admins, sudo can log which user performs a command. When all admins use the root account, all log entries will appear as user root and you can't tell who actually did it.
• Attackers who try to guess the password also need to guess a valid username.
• It prevents people from using root privileges for tasks which don't require it, because typing sudo in front of every command is additional work.

Answer 3

Another thing to consider if you log in as a normal user and then use sudo is that anyone who breaks your normal user account can modify your environment so that next time you log in and try to use sudo they intercept the request and capture your password and/or run their evil software as root.

Overall while I would discourage password based logins as root I think ssh key logins as root are overall no higher risk than other options for getting root access and are far more conviniant than having to use sudo.

Answer 4

Other reasons to not ssh as root:

• sudo may log every time it is used so you can keep better track of who did what when
• accidentally mistyping a command that you don't need privileges for is far less likely to do serious damage
• you can have a different key password from your user password, meaning an attacker would have to have the key AND 2 different passwords in order to compromise that system
• better ssh logs so you can know john logged into ssh and then linda instead of the mysterious root.
• if you are worried about timing attacks possibly being used to sniff out a password, you should be more worried about reusing a password with other servers/services. It would be better to enforce a policy of not reusing passwords since it is far more likely that an attacker found your username and password from another service than it is that an attacker has enough network access to determine how quickly keys are being pressed and actually use that.
• if you use a password manager and have to copy/paste passwords into your terminal then you can't time how long it takes for your fingers to move from key to key.