diff options
| author | Joey Hess <joey@kitenet.net> | 2014-04-24 18:13:52 -0400 |
|---|---|---|
| committer | Joey Hess <joey@kitenet.net> | 2014-04-24 18:13:52 -0400 |
| commit | 2d711db6451bcf1dbbec4ba93687930221380088 (patch) | |
| tree | 9ec5554a4504908b8ef8260ba044770c1a8f8549 /doc/todo/ssh__95__user_+_sudo | |
| parent | c4f364b249b810410d329a932dea883f36b9a712 (diff) | |
| parent | 44005ac53d3316ced3e067fb82971472874ae019 (diff) | |
Merge remote-tracking branch 'origin/master'
Diffstat (limited to 'doc/todo/ssh__95__user_+_sudo')
| -rw-r--r-- | doc/todo/ssh__95__user_+_sudo/comment_1_3bc008e42587a3313f81ee740d7d80f0._comment | 10 | ||||
| -rw-r--r-- | doc/todo/ssh__95__user_+_sudo/comment_2_35722c7d6f6c3e2315fbf72878066c01._comment | 8 |
2 files changed, 18 insertions, 0 deletions
diff --git a/doc/todo/ssh__95__user_+_sudo/comment_1_3bc008e42587a3313f81ee740d7d80f0._comment b/doc/todo/ssh__95__user_+_sudo/comment_1_3bc008e42587a3313f81ee740d7d80f0._comment new file mode 100644 index 00000000..e0dc1d7f --- /dev/null +++ b/doc/todo/ssh__95__user_+_sudo/comment_1_3bc008e42587a3313f81ee740d7d80f0._comment @@ -0,0 +1,10 @@ +[[!comment format=mdwn + username="http://joeyh.name/" + ip="209.250.56.214" + subject="comment 1" + date="2014-04-21T13:31:13Z" + content=""" +Running propellor that way would probably need ssh to allocate a tty in order for sudo's password prompt to work. And it adds complexity. Does it add security? I don't think so, PermitRootLogin=without-password or PasswordAuthentication=no is not going to let anyone brute force the root account. + +PermitRootLogin=forced-commands-only might be worth making easy to set up, so the only command that can be run with some special propellor-specific ssh key is propellor. +"""]] diff --git a/doc/todo/ssh__95__user_+_sudo/comment_2_35722c7d6f6c3e2315fbf72878066c01._comment b/doc/todo/ssh__95__user_+_sudo/comment_2_35722c7d6f6c3e2315fbf72878066c01._comment new file mode 100644 index 00000000..8dc6299b --- /dev/null +++ b/doc/todo/ssh__95__user_+_sudo/comment_2_35722c7d6f6c3e2315fbf72878066c01._comment @@ -0,0 +1,8 @@ +[[!comment format=mdwn + username="gueux" + ip="109.190.19.251" + subject="comment 2" + date="2014-04-21T13:54:39Z" + content=""" +I didn't knew \"PermitRootLogin=forced-commands-only\", it seems great! +"""]] |