Chris's Wiki :: blog/sysadmin/ManyRootPasswordsProblem

A brief sad note about root passwords

April 4, 2007

As far as I can see, the inevitable result of having several different root passwords across your systems is that a smart intruder who compromises /bin/su on a single system will sooner or later collect all your root passwords.

(Or perhaps other people are better than we are at typing the right root password at the current Password: prompt.)

(Please do not suggest sudo as the solution. For a start, we'd still want actual root passwords that are distinct from our own passwords.)

Comments on this page:

From 145.99.219.147 at 2007-04-09 16:10:26:

Won't one-time passwords (with sudo) help you? We use tokens with OTP, and have the machines authenticate to a RADIUS server... saves us from remembering all these (root) passwords, and... it's different from the password you logged in with (allthough that's in most cases also OTP, it was a one-time password after all ;-)) Must admit that sometimes I'd rather type in the root password with su (that I do know anyway) than use the token. It's faster.

By cks at 2007-04-10 13:17:26:

Convenient one-time passwords would actually solve a bunch of problems (including the traditional one where two only partially overlapping groups need to have root on a single server, and neither wants to share their usual root password).

Part of the trick is getting them configured, and part of the trick is trust delegation issues depending on how the OTP system works. (You don't want to delegate to an out of group OTP server, and you may not want to give the OTP server your master password.)

Written on 04 April 2007.

«	Social problems are the real problems

An irritation about rails