Re: to root or not (was SuSE 8.2 X permisions)

On Thu, 2003-05-29 at 12:52, John S. Andersen wrote:
> On 29 May 2003 at 15:11, Christian T. Steigies wrote:
> 
> > On Thu, May 29, 2003 at 12:53:57PM -0700, michael russell wrote:
> > > I don't think this sets your Display var....
> > > I know ssh will, but does sudo?
> > 
> > AFAIK it does not have to. Did you try it? Works for me(TM).
> > 
> > ssh on the other hand should not even allow you to log in as root, 
> if
> > you care a little bit for security.
> 
> 
> Given that you have to be root a some time or other and very often 
> from some other site (although probably not with a laptop), ssh in as 
> a user and then su to root is NO MORE secure than ssh to root.  
> 
> You are kidding yourself if you think this buys you anthing.  A 
> properly  set up ssh configuration with a PASSPHRASE protected 
> private key file has never been cracked.   And if it were cracked
> then they would capture your su to root password just as easily.
> 
> Even PASSWORDS transmitted via ssh are securely encrypted, and no 
> exploit has successfully been able to intercept and decode them, 
> although some one has published a paper speculating on the ability to 
> do so based on the timeing of the keystrokes.  Its never actually 
> been done in the wild.
> 
> Bugs in some implimentations do provide exploits for SSH1 but not by 
> cracking or intercepting the stream.  SSH2 is not subject to this
> bug.

All true enough for an environment where there's only one admin.
However, if there are multiple admins you'd better disable direct root
logins to ssh, or else you lose all ability to track who was in the
machine when. Even if your admins are in the habit of su - or sudo bash
as soon as they login, you still have the access log and various
.bash_history's to work with. I've used this information to do forensics
that caught someone red-handed in trying to foist their screw-ups onto
someone else, and it would not have been possible if I hadn't introduced
and enforced a no-direct-login-to-nameless-accounts policy two weeks
earlier.

-- 
Jack Coates
Monkeynoodle: A Scientific Venture...
http://www.monkeynoodle.org/resume.html