1

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and sensible to restrict admin user or maybe even root login by a hardware device? Meaning that it wouldn't be possible to log in as root if, for example, a certain USB device is not attached to server. Would that make sense or maybe even increase the complexity more than security?

The server is being administrated without any remote access/SSH.

2 Answers 2

2

In addition, I would add that most attackers don't directly log in via the console or ssh, but instead use bugs in other software in order to break out into a root shell or elevate their privileges. Adding 2-factor authentication or other mechanisms will definitely improve your security posture, but must be viewed as part of a larger overall hardening strategy.

0

This is called two-factor authentication. It already exists, though it may not be trivial to implement in all cases.

3
  • Yes, I figured it out it would be sort of 2-f auth. after I posted it. "It exists" in terms of other people had this idea already or there are ready-to-use tools? Commented Mar 31, 2014 at 14:56
  • @ScepticalJule An example done with TOTP and PAM. spod.cx/blog/…
    – Adi
    Commented Mar 31, 2014 at 15:13
  • There's a PAM module for this: pamusb.org. It allows 2 factor authentication with a USB dongle.
    – ndrix
    Commented Apr 1, 2014 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .