From owner-freebsd-questions@FreeBSD.ORG Thu Jan 21 07:46:24 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5435E1065676 for ; Thu, 21 Jan 2010 07:46:24 +0000 (UTC) (envelope-from mail25@bzerk.org) Received: from ei.bzerk.org (tunnel490.ipv6.xs4all.nl [IPv6:2001:888:10:1ea::2]) by mx1.freebsd.org (Postfix) with ESMTP id BA06E8FC0C for ; Thu, 21 Jan 2010 07:46:23 +0000 (UTC) Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1]) by ei.bzerk.org (8.14.2/8.14.2) with ESMTP id o0L7kJr1022412; Thu, 21 Jan 2010 08:46:19 +0100 (CET) (envelope-from mail25@bzerk.org) Received: (from bulk@localhost) by ei.bzerk.org (8.14.3/8.14.2/Submit) id o0L7kJC9022411; Thu, 21 Jan 2010 08:46:19 +0100 (CET) (envelope-from mail25@bzerk.org) Date: Thu, 21 Jan 2010 08:46:18 +0100 From: Ruben de Groot To: Steve Bertrand Message-ID: <20100121074618.GB22231@ei.bzerk.org> Mail-Followup-To: Ruben de Groot , Steve Bertrand , "Aryeh M. Friedman" , freebsd-questions@freebsd.org References: <4B57CE44.9060404@gmail.com> <4B57CEB5.2050001@gmail.com> <4B57D36A.3010303@ibctech.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4B57D36A.3010303@ibctech.ca> User-Agent: Mutt/1.4.2.3i X-Spam-Status: No, score=-4.3 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ei.bzerk.org X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0.1 (ei.bzerk.org [127.0.0.1]); Thu, 21 Jan 2010 08:46:22 +0100 (CET) Cc: "Aryeh M. Friedman" , freebsd-questions@freebsd.org Subject: Re: ssh to root X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jan 2010 07:46:24 -0000 On Wed, Jan 20, 2010 at 11:09:14PM -0500, Steve Bertrand typed: > Aryeh M. Friedman wrote: > > I need to set up a machine so that I can type "ssh [host]" as root from > > some other host and I get a prompt with super user privs... I already > > have set this up for user@host for root and ssh host for normal users... > > but root still asks for a password after I set the authorized_keys file > > in ~root/.ssh.. I have looked at ssh_config(5) but can't tell what > > option (if any) does this... if anyone is coruious the final goal here > > is to set up a sysutils/fusefs-ssh for this host (already installed and > > working for normal users but want to make it so it is done as root) > > Don't do it. > > *never* permit root-level access directly to *any* of your equipment. This is not very helpfull. In a private LAN these security mantras become a lot less obvious. You defend the LAN, not necessarily the individual systems. To Aryen: you might want to set PermitRootLogin to 'without-password' in /etc/ssh/sshd_config. That way, password authentications for root are still disabled and only users from machines with the correct private keys are allowed. Ruben > You want to provide as many levels of escalation to root level as you > can, no matter what protocol you are using. > > Auth in as a normal user (as you stated is already working), and then > use sudo(8) to escalate yourself. > > If you can already "ssh [host]" as a normal user, then you already have > the concept of keys. > > You can automate the escalation after you've authenticated, and then do > what you want to do. > > Seriously... > > ...don't do it. > > Steve > > ps. > > # pkg_add -r sudo > # rehash > # man sudo > > Then, when/if you have problems with specific functions that need root > privileges, ask those questions here instead. > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"