7

I'd like to setup sudo in such a way that it doesn't prompt me for a password when I authenticate to sshd with a key; but do otherwise.

I don't want an answer of "it doesn't work like that" because obviously that's the reason why I asked the question in the first place. I don't want the suggestion of creating two users for this.

Consider that for my personal servers I use Fedora, maybe there might be a hack with a temporal SELinux role based on authentication method, which can be then used in the sudoers file?

2
  • 1
    The problem is that sudo works at the user or group level. No matter how you worked out the mechanism of authentication, it still does not change the fact that the NOPASSWD option can only be applied at the group or user level. And either that user does have or does not have NOPASSWD for the commands specified in the sudoers file. The only solution is to have a separate user, OR may be to edit the sudoers source to your needs and compile your own custom binary.
    – Drav Sloan
    Sep 14, 2013 at 22:01
  • 1
    I asked a very similar question and got a good answer: unix.stackexchange.com/questions/520098/…
    – masgo
    May 22, 2019 at 7:28

1 Answer 1

6

Here is a paper that describes a possible implementation on BSD: https://www.usenix.org/legacy/event/lisa08/tech/full_papers/burnside/burnside_html/

It requires agent forwarding though, which I consider rather dangerous. Also, the site doesn't seem to link any sources or patches, and I don't think these changes have been implemented upstream.

It may also be possible to write a custom sudo auth plugin: http://www.opensource.apple.com/source/sudo/sudo-3/sudo/auth/API

Seems rather complicated to me though, and I don't know if it's even possible to query sshd whether public key authentication has been used.

If I were you I would just put my public key into /root/.ssh/authorized_keys and be done with it.

3
  • +1 for root's authorized_keys. ssh in as root for admin tasks, and as a normal user otherwise. Make sure that /etc/ssh/sshd_config has PermitRootLogin=without-password (to allow root logins with an authorised key only) or PermitRootLogin=yes if you want to allow root to login with a password or a key (less secure)
    – cas
    Sep 15, 2013 at 0:34
  • While your answer is straight to the point. I find it off putting when the context of usage is something like; I log often from others people terminal to show something I've done on my server and let them roam it, and that's why I have sudo setup to ask for a password every time. However that is an annoyance when I use it. Thanks for the info.
    – mhitza
    Sep 15, 2013 at 19:13
  • Well, if you want to be safe, don't let other people use your account. I consider having shell access to be almost equivalent to having root access - once your attacker has a shell, a root exploit is all that's needed. Someone could alias your sudo command, and then you've already lost. Sep 15, 2013 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .