Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'd say, maybe it's wiser to use

    PermitRootLogin forced-commands-only
If it's necessary to run something as root — declare it beforehead. If you encounter a situation when you need to run something unusual on an automated basis — login as administrator (or edit your Puppet/Chef/Ansible/alike rules if you're on the smart system management side) and update ~root/authorized_keys.

If one needs to SFTP as root, they could enlist `internal-sftp` target, too (although I haven't tested this, I don't SFTP as root and if I must update some files — I setfacl on them)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: