Re: SuSE 8.2 X permisions

On Thu, May 29, 2003 at 11:52:35AM -0800, John S. Andersen wrote:
> 
> Given that you have to be root a some time or other and very often 
> from some other site (although probably not with a laptop), ssh in as 
> a user and then su to root is NO MORE secure than ssh to root.  

Thats why you use sudo. You could for example allow certain acounts to
restart daemons, kill programs, or even reboot, depending on how much you
trust them, without giving them the root password (or using the root
password from remote sites). That might already be enough for remote access?

> You are kidding yourself if you think this buys you anthing.  A 
> properly  set up ssh configuration with a PASSPHRASE protected 
> private key file has never been cracked.   And if it were cracked
> then they would capture your su to root password just as easily.

It's an extra password the attacker has to know, no matter how hard or easy
it is to get. From the README.Debian

  Having PermitRootLogin set to yes means that an attacker that knows
  the root password can ssh in directly (without having to go via a user
  account). If you set it to no, then they must compromise a normal user
  account. In the vast majority of cases, this does not give added
  security; remember that any account you su to root from is equivalent
  to root - compromising this account gives an attacker access to root
  easily. If you only ever log in as root from the physical console,
  then you probably want to set this value to no.

So it gains you very little the maintainer says, thats why the default
setting now allows root login. I set it back, but maybe thats just a matter
of taste. I NEVER use my root password from a remote machine. I don't know
if this makes my machines more secure, but at least I feel better.

I think we are getting a little OT, the OP should have enough ideas now for
how to solve his problem.

Christian