0

I know it's strongly advised against enabling root access on server but as cracking SSH keys is almost impossible can I enable root access just by using ssh keys and be safe?

My OS is Ubuntu 16.04.

I guess universe has its own jokes but the funniest and saddest thing happens to me the day after I asked this question and my laptop's mainboard broke and now I'm glad I had another user apart from root which doesn't accept password and only connects via SSH keys.

  • you shouldn't use a computer regularly as root, mostly because it's harder to audit. Access as some other user then sudo/doas – Neil McGuigan Sep 22 '17 at 18:31
4

can I enable root access just by using ssh keys and be safe

This depends on how well you protect the private key belonging to the authorized public key.
I see no problem that somebody might brute-force the server directly to get access as root. But somebody might hack your client system, steal the private key and then use it to get root access to the server.

  • My private key is only on my own pc which is well protected. Therfore beside that there is no problem? – Amin Vakil Sep 22 '17 at 9:44
  • 1
    @AminVakil: Apart from having a SSH daemon running in the first place (i.e. increased attack surface in case of bugs) I can not see any additional problems. – Steffen Ullrich Sep 22 '17 at 9:50
1

(started as a comment - but getting a bit verbose....)

If its only on your own PC then it is not well protected - if you lose your PC you lose your server access. Protection isn't just about preventing others gaining access, its about ensuring authorized people continue to have access.

If you allow both password and keypair logins then your server is significantly more vulnerable - 'root' is a known username with privileges and hence frequently used in brute force attacks. Mitigations are to require membership of a specific group (doesn't protect 'root' but useful for 'bin', 'dev', 'apache' etc) port knocking and fail2ban.

Maybe it appears in your backups too. Maybe you have RAID to protect against data loss in hardware failures. Maybe you have an effective process for disposing of retired/broken storage. Maybe you have UPS to protect against corruption in power outages. Maybe you have IDS running on the device where the key is stored. Maybe you have IPS running in front of the device. Maybe this device is a locked down appliance only used as a terminal to your server. Maybe you have processes and technology in place to audit all the access on your server. Maybe your server uses strong password hashes and the server backups are managed securely.....

We can't say if you will be "safe" because this is a relative term - and we don't know what your definition of safe is nor the value of the assets being protected.

If it were my server and the gross value was less than a months income, I would be comfortable with using keypair logons along with fail2ban - but I'd never allow ssh logons as root remotely. The only scenarios where I couldn't log in using a different uid and su would be where the system is so broken that the sshd is unlikely to be running.

  • Of course I have another sudoer user with a very difficult password to guess for the case I lose my computer or I want to login to my server from somewhere else (which didn't happen in 2 years). – Amin Vakil Sep 22 '17 at 13:26
0

As far as the SSH implementation is concerned, you could. And mabye use some extra measures with firewall rules, custom 2-factor authendication etc. But, you have to be cautious of another thing, too. If someone gains access to this machine from another user and manages to escalate his priviledges to root, he will be able to open an SSH connection to his machine. So, consider this, too, before allowing a high priviledged user to use SSH.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.