I've got a few boxes all networked together on Amazon EC2, each of which are in automated communication with each other via SSH (rsync, etc). As such, I've created SSH keys on each of these machines to allow them to SSH into each other without requiring a password. Likewise, my personal account is key-based and passwordless as well.
To the best of my knowledge, I've secured SSH appropriately using the well-documented methods.
Under this configuration, I notice that I don't have to provide a password to use
sudo. If I try to
su root, I get nowhere, because root doesn't have a password. However, if I run a
sudo -i, I am asked for no password, and am immediately granted root. That worries me a bit.
So, two questions:
- Should this worry me, or am I being too paranoid?
- Is it possible to set a sudo password when using key-based SSH authentication?
Several of these boxes are web servers, and are hosting web applications of what I fear to be dubious quality. (I didn't write them, so they're dubious!) I've got Apache and the permissions on the servers configured such that a very unprivileged user (www-data) is serving the files, but my fear is that - somehow - an attacker could compromise a web application, escalate privileges to a more privileged user, and then simply
sudo -i to root.
I'm not aware of a vulnerability in my software that would allow www-data to escalate its privileges, but I would prefer having a password in place to use
sudo were that somehow to happen.
Also, for the record: I did try to set a password by logging in via SSH and then running
passwd, but it threw an error. I don't remember the exact phrasing, but it was something about a "token". Either way, the password didn't stick, which makes me think I'm misunderstanding something at a fundamental level here.
Any illumination on the subject would be very much appreciated. Thanks.
-- Update: 7 December 2011 --
Thanks for the thoughtful explanations, all. It does in fact seem like the issue lies in
/etc/sudoers. Thanks for pointing me in that direction.
I figured I'd document this for the sake of completing the discussion. When I looked into
/etc/sudoers, I encountered the following lines:
# ubuntu user is default user in ec2-images. # It needs passwordless sudo functionality. ubuntu ALL=(ALL) NOPASSWD:ALL
I am, in fact, using the ubuntu user for my privileged operations (though, again, the webserver is only running as
www-data), so I guess that explains the issue I was having.
If anyone wants to follow up with a guess why the ubuntu user needs passwordless sudo functionality, I'd love to hear it. Otherwise, at least for the time being, I think I'll let good enough alone and leave the configuration as-is. I don't want to break a working system while trying to preemptively solve a non-existent problem.
Thanks again for lending your time and expertise.