2

I have a server where I am the only normal user and I need to have password-based authentication enabled for SSH. I have configured iptables with recent module which throttles SSH connections and root logins over SSH are disabled. However, let's say that intruder is able to brute-force my SSH password. This means that once he has logged in as a normal user he can execute privileged commands using sudo with the same password. Am I correct that in such scenario it makes sense to configure sudo in a way that it asks for root password?

1
  • Did this answer your question? Dec 5, 2016 at 20:14

1 Answer 1

3

Yes, you should.

In a brute force attack against the raw hash, sudo won't help you. However, you should be aware that in other attacking methods, sudo is able to offer some protection.

If, for example, an attacker is able to break into your machine with an exploit, he does not know the password. Potentially delaying or stopping an attack as the attacker does not have the proper privileges to carry out system commands.

However, sudo should be a last line of defense. Once an attacker is in, they are in. Privilege escalation is a commonly practiced strategy. An experienced attacker should be prepared to escalate privileges.

4
  • So, the answer is: "yes" you should.
    – MikeP
    Dec 5, 2016 at 18:20
  • @GavinYouker Thanks! However, when I think about it, is there a point to use sudo in this scenario in the first place? If I configure sudo to use root password, then I might use su instead?
    – Martin
    Dec 6, 2016 at 9:56
  • 1
    You are correct. Since su logs you into the root account, you might as well you su instead. Let me know if you have any more questions. Dec 6, 2016 at 10:03
  • @Martin If I have answered your question correctly please mark it as the right answer for future viewers, thank you. Dec 6, 2016 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .