Hacker News Reader

Are your users evil, or just careless?

If they're evil, then after giving them root access, you can never take it back again. They can do anything to persist their access, and you will never forsee what they could do, so you shouldn't try.

If your users are careless, a simple note at the top of authorized_keys saying "Don't add anything to this file plz without asking the security team" should be sufficient.

View on HN

Thanks for your answer. Of course, in general, the users are not evil. However, I am thinking about the security concerns when someone is leaving the company. Maybe for some reason they turn evil and decide to place their key to still have access after they left.

If your main concern is just the keys file then maybe simply setting up a cron that would „echo "" > .ssh/authorized_keys” would do the trick. But like said - it's otheriwse an endless cat and mouse game. For examples you can look at King of the Hill CTF games on YouTube

This is a poor solution because I think most people just use ssh-copy-id and don’t actually look at the file. It ships with openssh. For the standard way that I copy my ssh keys to a new host, I’d never see that warning.

Reply on news.ycombinator.com