I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and sensible to restrict admin user or maybe even root login by a hardware device? Meaning that it wouldn't be possible to log in as root if, for example, a certain USB device is not attached to server. Would that make sense or maybe even increase the complexity more than security?

The server is being administrated without any remote access/SSH.


In addition, I would add that most attackers don't directly log in via the console or ssh, but instead use bugs in other software in order to break out into a root shell or elevate their privileges. Adding 2-factor authentication or other mechanisms will definitely improve your security posture, but must be viewed as part of a larger overall hardening strategy.


This is called two-factor authentication. It already exists, though it may not be trivial to implement in all cases.

  • Yes, I figured it out it would be sort of 2-f auth. after I posted it. "It exists" in terms of other people had this idea already or there are ready-to-use tools? – Sceptical Jule Mar 31 '14 at 14:56
  • @ScepticalJule An example done with TOTP and PAM. spod.cx/blog/… – Adi Mar 31 '14 at 15:13
  • There's a PAM module for this: pamusb.org. It allows 2 factor authentication with a USB dongle. – ndrix Apr 1 '14 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.