Ssh – sudo: don’t ask password when logged in with ssh key

sshsudo

I'd like to setup sudo in such a way that it doesn't prompt me for a password when I authenticate to sshd with a key; but do otherwise.

I don't want an answer of "it doesn't work like that" because obviously that's the reason why I asked the question in the first place. I don't want the suggestion of creating two users for this.

Consider that for my personal servers I use Fedora, maybe there might be a hack with a temporal SELinux role based on authentication method, which can be then used in the sudoers file?

Best Answer

Here is a paper that describes a possible implementation on BSD: https://www.usenix.org/legacy/event/lisa08/tech/full_papers/burnside/burnside_html/

It requires agent forwarding though, which I consider rather dangerous. Also, the site doesn't seem to link any sources or patches, and I don't think these changes have been implemented upstream.

It may also be possible to write a custom sudo auth plugin: http://www.opensource.apple.com/source/sudo/sudo-3/sudo/auth/API

Seems rather complicated to me though, and I don't know if it's even possible to query sshd whether public key authentication has been used.

If I were you I would just put my public key into /root/.ssh/authorized_keys and be done with it.

Related Solutions

The correct way to abort an operation from the sudo password prompt

What I usually do is Ctrl + Z to suspend the task, then kill %1 or even kill -9 %1 to stop:

> sudo ls
[sudo] password for user:

Ctrl + Z

[1]  +   512 Suspended                     sudo ls
> kill %1
[1]  + Suspended (tty output)        sudo ls
> kill -9 %1
[1]    Killed                        sudo ls

(In case you have more background tasks in your shell: The number you need to give after the percent sign is the one in brackets []).

Linux – How to transition into another domain when invoking sudo

You can specify a transition in a custom policy file (.te) like this:

module collectdlocalexec 1.0;

require {
        type collectd_t;
        type user_home_t;
        type unconfined_t;
        type shell_exec_t;
        class capability {setgid setuid };
        class file { execute read open };
        class process transition;
}

allow collectd_t self:capability { setgid setuid };
allow collectd_t user_home_t:file { execute read open };
allow collectd_t shell_exec_t:file execute;
allow collectd_t unconfined_t:process transition;

type_transition collectd_t user_home_t:process unconfined_t;

Assuming that the collection script is located under a user's home directory (and that is labeled with user_home_t).

Best Answer

Related Solutions

The correct way to abort an operation from the sudo password prompt

Linux – How to transition into another domain when invoking sudo

Related Question