up vote 2 down vote favorite
2

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the things it needs to do (create directories in /srv, create a new VirtualHost, restart Apache, etc).

The question I have is simply this: at the moment the root user has no SSH key, but I'll need one in order to git clone from BitBucket. Are there any security issues with generating one? That is, if I run ssh-keygen as root so I have public and private keys for the root user, will I be making the server less secure in any way?

Incidentally, this is a script that is already in use and has been working fine, but until now the repo I'm cloning from has been a local one, hosted on the same server. I've recently switched to hosting it remotely (on BitBucket), so I need a "deployment key" in order to git clone it.

share|improve this question
  • Why are you reinventing the wheel? Ansible/Chef/Puppet are already there. – Deer Hunter May 18 '15 at 17:31
  • 4
    I suspect your basic premise is wrong. You do not need to sudo to the root user to accomplish this. Change the ownership and permissions on the subdirectory of /srv you're deploying these sites to, do the same for the directory where Apache configurations are stored in, and configure /etc/sudoers to allow this user to restart apache. – Stephen Touset May 18 '15 at 17:33
  • @DeerHunter Thanks, I'm aware of those, and in fact I do use Puppet elsewhere. In this case I'm using my own bash script. Never mind the details, though: my question is a really general one - I'd like to know simply whether there's any danger introduced by running ssh-keygen for the root user. – Nick F May 18 '15 at 17:40
  • @StephenTouset Thanks, that's an interesting point, and would probably be the best option. However, I've got a number of sites already running and in use in the /srv directory and so I'm wary of doing a recursive change of permissions in case it has any knock-on effects on the existing sites. If there are no security considerations in creating a public key for my root user, then I know that doing that and sudoing my install script when I need to would work without any risk of unforeseen consequences. – Nick F May 18 '15 at 17:44
  • 2
    @NickF If you really want to focus on "whether there's any danger introduced by running ssh-keygen for the root user" then perhaps you should edit the extraneous details out of the question to get away from the specifics of your situation. Otherwise you'll continue getting alternate solution suggestions. – Mike Ounsworth May 18 '15 at 17:49
up vote 7 down vote accepted

No, having keys for your root user does not impact your security profile. It is wise though to disable root login in ssh and NOT have an authorized_keys in your /root/.ssh/ folder.

However. I got the feeling your going about this the wrong way. Personally, I would not use the root user in this manner (but a system user like www-data) and make several command and control scripts that reload Apache config for example that are specified in the sudoers list (with full specification) so that my user can simply call a script that does have the rights to do the 'special' actions needed.

This way you will have an audit log of what has happened. This limits what can be misdone by the user in case of a compromise and does not expose your complete system.

The sudoers file (and the sudo command) have an option to make them work without password entry (:nopasswd:). You can also limit the commands and calling users in the file. As a bonus you can have a separate user with limited rights to have the deployment access, further limiting potential harm.

share|improve this answer
  • Thanks for a very clear and helpful answer. One question though: I do in fact already have an authorized_keys in my /root/.ssh/ folder. The server in question is an Amazon EC2 instance, and it seems to have one by default (it contains a single authorized key, with the name of the server itself). Am I right in thinking that's probably not a problem? Is creating a public/private key still safe? Thanks again. – Nick F May 18 '15 at 23:53
  • 3
    anyone that has the 'private key' that goes with the public key in the authorized_keys file can get acces to your system without a password (assuming the key is not encrypted with a password) I would remove the contents of the authorized_keys file and move it to somewhere else, to see if you really need it. But bear in mind. YOU need some way into your system. this entry could be that. (so double check that) – LvB May 19 '15 at 0:03

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.