News for hackers. Stuff that matters.

A comment on List of Unix binaries that can be used to bypass local security restrictions. Parent comment

Re:List of Unix binaries that can be used to bypass local se... by gsich on Friday July 07, 2023 @08:37AM (#36630762)
>The downside is that I allow "root SSH", contrarily to every single best practice out there. The upside... Well. Is that there's no "sudo" installed on my workstation.

Allowing root login is fine. The best practice is not to allow passwords for root login.

[ Parent | on HN ]
Re:List of Unix binaries that can be used to bypass local se... by johnklos on Friday July 07, 2023 @12:23PM (#36634084)
The even better than "best" practice is to not allow passwords for any login. Keys really aren't that hard.
[ Parent | on HN ]
Re:List of Unix binaries that can be used to bypass local se... by TacticalCoder on Friday July 07, 2023 @12:47PM (#36634491)
> The best practice is not to allow passwords for root login.

My sshd is configured to not allow passwords logins at all: it's U2F/Yubikey only.

[ Parent | on HN ]
Re:List of Unix binaries that can be used to bypass local se... by gsich on Friday July 07, 2023 @05:09PM (#36638328)
I somewhat like smartcards more. Takes use of the slot, not wasting rare USB ports on notebooks. I don't why there are so few USB ports, but that's another discussion.
[ Parent | on HN ]