2

After setup ubuntu with default settings, It allows user to login with password, so I use passwd -l [username] to forbid password login both in ssh and console.

But when I use sudo to execute commands, it needs password so I can't use sudo any more.

Is there any solution that I can use sudo again, another question is how to forbid password login both in ssh and console but keep sudo password auth available?

|improve this question
  • 2
    why would you forbid password login? what's the motivation? – strugee Oct 12 '13 at 3:30
  • More security. System only allows ssh private key login. – elprup Oct 12 '13 at 3:33
  • 5
    What if your SSH daemon fails? Then you're screwed, as you are right now. The correct solution is to disallow SSH passwords but still allow console logins. – strugee Oct 12 '13 at 3:36
  • 2
    What better security is there than that? No one can get in. – Andrew Cheong Oct 12 '13 at 5:49
  • Just forbid password login, only allow ssh private key login. – elprup Oct 12 '13 at 6:53
1

You could boot up in single user mode to get a root console. You could then mount your filesystem, and fix the affected account.

(This is assuming grub hasn't been password locked also ..., you hold down shift during boot to bring up grub, and add 'single' to the boot statement after the word 'splash' )

As for best practice, I agree with strugee's comment.

  • Just remembered- Ubuntu has that 'recovery mode' grub option, so you may not even have to edit your boot command...
|improve this answer
  • yes, I just use recover mode, login as root, remount root partition and get recovered. But is it possible to recover without physical access? – elprup Oct 12 '13 at 7:27
  • @elprup Only if you have PermitRootLogin yes in your sshd_config. Or if you have a known unpatched vulnerability on your system. :) – peterph Oct 12 '13 at 8:21
  • @peterph - I think you would also have had to enable root account login (sudo passwd), it's disabled in it's default state in ubuntu. – Niall Byrne Oct 12 '13 at 11:13
  • @elprup You configured your system to prevent any method from logging in as root. So no, unless you can access it from the outside or you have a vulnerable application running, you can't log in as root. – Gilles Oct 12 '13 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.