Source
r/selfhosted•
forgetfulcoder

Is there some kind of centralized authentication replacement for sudo?

This is my idea:

On my desktop I have a program that I unlock with a password, this program authenticates with some kind of software I'm running a raspberry pi. I SSH into one of my machines and run sudo su or whatever the replacement would be. Sudo communicates with the auth server which replies "All good" and I get root access.

Does something like this exist? The idea is that if I need to ssh into multiple machines I only need to enter my password once rather than several times.

Posted Jul 17, 2021, 7:33 PM UTC

25
[deleted]•

[deleted]

9
adamshand•

The proper way of doing this is Kerberos. It's been around forever, is what Active Directory implements under the hood, and works. But it's complicated and can break in all kinds of obscure ways (eg. clock gets out on a server, can't log in anymore). In a homelab environment you almost certainly don't want to do this unless your goal is just to learn.

Th easiest way to implement what your asking is to:

  1. setup passwordless SSH from your primary workstatop/laptop using keys and ssh-agent
  2. once you have that working, configure your SSH client to ForwardAgent and all your SSH servers to AllowAgentForwarding yes
  3. at this point you should be able to login to any of your servers without a password and from there, login to any other server without a password
  4. now configure /etc/sudoers on all your computers to allow your username to use sudo without a password.

The advantage of this is that if it breaks you just have to use your password and everything will still work. More complicated setups will typically lock you out of your server(s) if something goes wrong.

The disadvantage of this is that all of these steps weaken your security. But that's life. As the sysadmin you get to choose how much security you want to sacrifice for convenience. Personally I do all of the above except allow passwordless sudo.

7
justinhunt1223•

Your comment about only entering your password once it's confusing. As far as I know, you aren't going to get around SSH wanting a password without using ssh-copy-id. Just because you are elevated to root user on machine 1 doesn't mean you can jump over to any machine with a root user - even if the password is the same. Sudo usually remembers your password for the current session though, provided you are running commands on the same system?

1
koalillo•

You can configure sudo not to request a password.

-2
justinhunt1223•

I didn't downvote you but this doesn't solve the problem. Needing a central authority management isn't solved by removing sudo asking for a password. It may work T times, but it doesn't solve the problem and actually creates a security issue.

1
koalillo•

Whether that solves or not the problem depends on the original poster. If the OP's problem is really about the convenience of inputting a password, then tuning password prompts (which is not binary), can help.

The security of being prompted for a sudo password is relative, esp. depending if you already trust keys, or even if you already are using password for authentication.

I consider sudo password prompts a convenient way to remind myself of being careful, as it indicates I'm doing something with additional privileges- that's one of the main reasons I set up FreeIPA in my personal infra instead of just distributing ssh keys. But I don't really think I solve any threat vector using them (if someone can lift my SSH, he can login to any of my boxes, but a malicious sudo in my user path, and lift my password).

1