Re: Debian security: need recipe for blocking root ssh access AND all ssh password access
On Fri, Feb 19, 2016 at 09:30:20AM +1300, Richard Hector wrote:
> That then means that you don't get to choose which people have root on
> which boxes - anyone who gets the rule gets the lot. And that includes
> anyone who leaves, of course.
Yes, but a leaked root password for one host does not translate into a leaked
root password for other hosts, so there are some advantages. If the routine
additionally concatenates a fixed password string, you can rotate that when
staff leave and regenerate/reset all the passwords.
> I think a better solution in the end is to generate a random password
> for each box, and leave it, on paper, in a safe or similar. It's very
> rare anyone needs to use it.
In my past jobs we've always ended up doing something like that in the end,
never getting an algorithmic solution like the above off the ground, but it
does sound attractive to me.
--
Jonathan Dowland
Please do not CC me, I am subscribed to the list.
Reply to: