Re: Re: Any update on SSH brute force attempts?

[Barrie Dempster <barrie () reboot-robot net>]

On Mon, 2004-10-18 at 20:43 +0530, Raj Mathur wrote:
> Using su forces the use of passwords, which are difficult to manage in
> a multi-admin scenario.  For instance, you may have to give the root
> password to 3 different people (1 in each 8-hour shift). 

I didn't say su, I said _sudo_, theres a major difference between the
two. with sudo you can effectively define groups and fine control the
access given to these groups without requiring additional passwords.
If I had said su, that would have been bad for the reasons you pointed
out, sudo however is much better than su in a multi-admin environment
and better than solely relying on keys, the user just has to know their
non-privileged login details (pass[word|phrase|key]) and they will be
able to access selected or all root functions depending how you want to
set it up, in this scenario you can also prevent "lesser" admins from
accessing all root functions.

With this method you could use keys as the authentication method (which
is what I would use) just like you said, you'd also have the control
over the admin groups functions with minimal administration and you
would be maintaining least privilege access, all good.

-- 
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Attachment: signature.asc
Description: This is a digitally signed message part