4

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ssh configuration:

  • log-in with SSH-Keys only,
  • no root log-in allowed.

Then I log in as my main (and essentially only) user, and use su to switch to root when administrative operations are necessary.

Browsing around the site, I gathered that sudo rights to the user is a preferred option. But the main common argument for it, is when sharing administrative rights. Which is not an issue for me. I can see the following

  • su > sudo: two passwords required: the ssh-key to get in as a user and then the root password. So some form of double protection.
  • sudo > su: if sudo is set with NOPASSWD then no password is transmitted over the internet, and whatsmore no password is entered, defeating the keyloggers.
  • Direct SSH-Key to root: facilitate remote backup, auditing, etc. But seems less secure as root username is known and a single password (ssh-key) is required.

What is the most secure way to get to do administrative tasks on my own server?

Should I assume that SSH-Keys protection leave me only to choose between ssh-key theft or keylogging? And what is the most common of those? If that's relevant, I only connect to it either directly from my home computer or, from my mobile phone via another server (so that the ssh-key isn't stored on my phone).

1

Well If you are using sudo you can use the sudo file (only editable by those with permissions) to control what your user can do, for example you could turn your own user into a root with sudo -s or you could allow them to only use certain commands and even parameters you allow them to in the sudo file, so if I am understanding correctly (someone correct me if i am wrong)

The best choice is sudo and locking down / opening up certain rules for your user so it can perform certain tasks, you should only ever use root as a last resort for the saftey of your own system.

I forgot to add, having a password is the better way to go if you are constantly changing machines though this leaves you open to brute force attacks. unless obviously you use a fail2ban and often rotate passwords.

Using a key and a password is the best option but that means every device you use will need this key.

  • Suddenly also logs nicely. – Neil Smithline Dec 2 '15 at 15:25
  • Wait, I'm not sure I follow... in general ssh-key and sudo with some rights on the user is the best solution, but if I often change the machine from which I log in, better a key and password?? And yes, I do use fail2ban. – bilbo_pingouin Dec 2 '15 at 19:54
  • well if you are worried about the .pem file (or what ever format you use for your crt) then you can install the key on multiple devices and use a password for the server AS WELL which means if your device is ever lost or stolen by ninjas you still have the other part of the authentication in your head! obviously you dont need to do it a password (a randomly generated one) is best secure, dont have your password after your cat, mittens5 is not a secure password :P – TheHidden Dec 3 '15 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.