2

Is it possible to set up a specific SSH-RSA key (via another user i.e. "ec2-user") to have ability to sudo into root.

I.e.

  1. You login with key to "Bob" (ec2-user). Currently user "Bob" can sudo into root.

  2. "Bob" now has two keys. One can sudo su into root, one can not.

3

Yes. It is possible using pam_ssh_agent_auth package if your distribution provides. It can allow you to execute sudo based on pam module, which checks possession of ssh key in ssh-agent.

Short story long

Setup

  1. Install pam_ssh_agent_auth package from package manager
  2. Modify /etc/sudoers, preferably using visudo and add line

    Defaults    env_keep += "SSH_AUTH_SOCK"
    
  3. Edit /etc/pam.d/sudo and add (as a second line after #%PAM-1.0)

    auth     sufficient   pam_ssh_agent_auth.so file=/etc/security/authorized_keys
    

    and comment out line

    #auth       include      system-auth
    

    to disallow normal system authentication for sudo command

  4. Create the "privileged" key-pair that should have access to the sudo command and the store public part as /etc/security/authorized_keys on server.

    ssh-keygen -t rsa -b 2048
    cat ~/.ssh/id_rsa > /etc/security/authorized_keys
    

Usage

  1. On client open ssh-agent and add above mentioned key:

    eval $(ssh-agent) ssh-add ~/.ssh/id_rsa

  2. Connect to server with agent forwarding

    ssh -K server

  3. Run sudo as you wish

This works fine on Fedora/RHEL/CentOS systems, from what I tested so far.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.