I completely agree that when using ssh you should use certificates rather
than keys, but you should also log onto your own ID and not onto root, and
then use sudo to do the priviledged bits. All my ssh servers are set to
refuse root logon, and to insist on keys not passwords.
David
Rob van der
Heij To: [EMAIL PROTECTED]
<[EMAIL PROTECTED] cc:
m> Subject: Re: Root passwd
Sent by: Linux
on 390 Port
<[EMAIL PROTECTED]
ARIST.EDU>
06/03/2004
05:06 PM
Please respond
to Linux on 390
Port
David Goodenough wrote:
>You can also use sudo, and that gives two things.
>
>Firstly very few people actually need to know the root password, and
>secondly it logs everything that is done using sudo and by whom, giving
you
>an audit trait. Authentication is done with their own passwords and the
>/etc/sudoers file which says what that person is allowed to do.
>
>David
>
>
Yep. If you try hard enough you can get most done through sudo and we do
so on our shared systems because of the audit trail (see
http://www.vm.ibm.com/events/nl78.PDF for proof ;-). We still prefer to
authenticate with private key rather than type the password on all
foreign systems.
But on systems where I am the only root I tend to logon root directly
through public/private keys.
Rob
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or
visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
