I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/pam_ssh_agent_auth.8.html
Is using a forwarded agent with only one dedicated key and SSH-ASKPASS for confirmation more secure than using passwords for sudo operations?
If "pam_ssh_agent_auth" is not secure on a remote server, are there any secure alternatives?
I read about using the "targetpw" configuration for sudo (https://www.sudo.ws/docs/man/1.8.14/sudoers.man/). With this option enabled, the user must enter the targets users password (e.g. root password) This adds a second layer of security, because the attacker must compromise the user account and get the root password. One drawback is, if the password is known, the attacker can use the password at any time.
