Changes between Version 3 and Version 4 of SystemAdministration/Security/OpenSSH

Timestamp:

07/21/15 11:28:27 (9 years ago)

Author:

Sander Maijers

Comment:

Explain root login

SystemAdministration/Security/OpenSSH

@@ +1 @@
+= Generating an OpenSSH key pair =
 == Guidelines ==
 
@@ -35 +36 @@
 == OSX ==
 
-If ed25519 is not available on OSX, install openssl via homebrew ([http://epocsquadron.com/a-comprehensive-ssh-key-primer/ reference]). 
+If ed25519 is not available on OSX, install `openssh` via homebrew ([http://epocsquadron.com/a-comprehensive-ssh-key-primer/ reference]). 
+
+= Configuring an OpenSSH client and server for secure root login =
+
+Suppose you want to be able to log in to host B from host A, both as your user and as the superuser. The latter you need in case you want to use e.g. `rsync` from B to A as superuser to read otherwise inaccessible files on B's filesystem. You want to use key pairs with passphrase-protected private keys and no password authentication. The only exception where passwords are at play at all, is for your OS account and `sudo`. You want the barrier to log in as root to be at least as strong as logging in as your user and then performing `sudo su`.
+
+Generate two key pairs, with base file names `root@B` and `yourusername@B`. 
+
+Edit your OpenSSH client configuration on A to point to the file paths of these keys, for instance:
+`~/.ssh/config`:
+{{{
+Match originalhost B
+    HostName B.Bdomain.Btld
+Match originalhost B user root
+    IdentityFile "%d/.ssh/keypairs/root@B"
+Match originalhost B user sanmai
+    IdentityFile "%d/.ssh/keypairs/yourusername@B"
+}}}
+
+Make sure you can log in to B as your user and that you are allowed to perform `sudo -e`. Also make sure that the OpenSSH server configuration is otherwise secure, f.i. forbidding any authentication method other than `PubKeyAuthentication`.
+Now edit the OpenSSH server configuration and put at the end of the file:
+`/etc/ssh/sshd_config`:
+{{{
+PermitRootLogin no
+
+Match LocalAddress 127.0.0.1
+    PermitRootLogin without-password
+}}}
+
+Or to be compatible with IPv6 (untested):
+`/etc/ssh/sshd_config`:
+{{{
+PermitRootLogin no
+
+Match LocalAddress 127.0.0.1,::1
+    PermitRootLogin without-password
+}}}
+
+Restart the OpenSSH daemon.
+
+== Logging in ==
+Using this setup is rather simple:
+`ssh yourusername@B`
+or
+`ssh root@B`
+
+When authenticating as root, you will be asked both the passphrase of the private key you associated with yourusername as well as that or the private key for root.
+
+`rsync root@B:/etc/hostname /tmp/hostname`
+
+'''Only use the root private key when it's absolutely necessary.'''
+
+This way you concentrate your activity within the easier to audit sudo framework, and you will reduce your susceptibility to compromise of the passphrase for root@B by means of keylogging on A.
 
 {{{