Specific user's SSH-RSA with root access (via AWS EC2)

Question

Is it possible to set up a specific SSH-RSA key (via another user i.e. "ec2-user") to have ability to sudo into root.

I.e.

1. You login with key to "Bob" (ec2-user). Currently user "Bob" can sudo into root.

2. "Bob" now has two keys. One can sudo su into root, one can not.

Answer 1

Yes. It is possible using pam_ssh_agent_auth package if your distribution provides. It can allow you to execute sudo based on pam module, which checks possession of ssh key in ssh-agent.

Short story long

Setup

1. Install pam_ssh_agent_auth package from package manager

2. Modify /etc/sudoers, preferably using visudo and add line

   Defaults    env_keep += "SSH_AUTH_SOCK"
   

3. Edit /etc/pam.d/sudo and add (as a second line after #%PAM-1.0)

   auth     sufficient   pam_ssh_agent_auth.so file=/etc/security/authorized_keys
   

   and comment out line

   #auth       include      system-auth
   

   to disallow normal system authentication for sudo command

4. Create the "privileged" key-pair that should have access to the sudo command and the store public part as /etc/security/authorized_keys on server.

   ssh-keygen -t rsa -b 2048
   cat ~/.ssh/id_rsa > /etc/security/authorized_keys
   

Usage

1. On client open ssh-agent and add above mentioned key:

   eval $(ssh-agent) ssh-add ~/.ssh/id_rsa

2. Connect to server with agent forwarding

   ssh -K server

3. Run sudo as you wish

This works fine on Fedora/RHEL/CentOS systems, from what I tested so far.