I'm trying to find a good method for hardening a server while allowing automated remote management via ssh (ansible).
The popular choice is login with a normal user and then use sudo, but this has some problems:
Passwordless sudo: this is a no-no. It's just as if you allowed direct login to root.
Sudo with password in a file somewhere. Don't like the idea, writing the password in a file opens a world of possible attacks.
Then I've seen some people suggest allow root login via ssh but only from localhost. At first sight this seems like a good idea but after a bit of thinking it's not a good one. Once an attacker gets into any account in the machine s/he can attack root's ssh as if doing it remotely. It's like putting a second lock on a security door. It will take longer for the attacker to break it but it won't be any harder.
It can even make it easier because the attack surface is greater. If using SSH Agent Forwarding to enter root via a normal user, an attacker could modify the user's login scripts to use the forwarded authentication to gain root and then restore the login scripts and clean up the logs so the user has no clue to what has happened.
What would you suggest?