On 10/03/2016 11:03 AM, Chris Murphy wrote:
On Mon, Oct 3, 2016 at 8:57 AM, Chris Murphy
<lists(a)colorremedies.com> wrote:
> Hi,
>
> I'm noticing even with cockpit-0.117 in Fedora 24 Server, that it
> supports ssh key assignment for users. Since it's possible to login to
> cockpit out of the box, and setup ssh keys via the web interface, is
> it now practical to set these by default in the F26/F27 time frame?
> And if not, what additional work needs to be done?
>
>
> Disable root logins with ssh
> /etc/ssh/sshd_config PermitRootLogin no
>
> Disable root entirely (sudo -i still works)
> usermod -p '!' root
>
> Disable password login with ssh (key only)
> /etc/ssh/sshd_config PasswordAuthentication no
>
> In my case I use all three as pretty much the first step for a new
> Fedora 24 Server installation.
An alternative might be disabling sshd out of the box. It could be
turned on via cockpit, and require no additional configuration to ssh
login. That perhaps is a compromise between better out of the box
security and usability.
Unfortunately, there are two large problems with this approach: Cockpit and Ansible.
Cockpit relies on the SSH port being available if we want to use it to
monitor/manage multiple systems. Similarly, if we want our systems to be
manageable via Ansible out-of-the-box, they're going to need SSH running with
some sort of a predictable, root-equivalent user at least.