search

serokell / deploy-rs

A simple multi-profile Nix-flake deploy tool.
Other
1.42k stars 101 forks source link

is `Interactive sudo is enabled! Using a sudo password is less secure than correctly configured SSH keys.` warranted in my case ? #299

Open teto opened 2 weeks ago

teto commented 2 weeks ago

So when I use deploy-rs, I get the following warning:

🚀 ℹī¸ [deploy] [INFO] Evaluating flake in .
🚀 ⚠ī¸ [deploy] [WARN] Interactive sudo is enabled! Using a sudo password is less secure than correctly configured SSH keys.
Please use keys in production environments.
🚀 ℹī¸ [deploy] [INFO] You will now be prompted for the sudo password for redacted.com.

I do use ssh keys to authenticate to the server with a plain user. I have root ssh access disabled for security reasons. And I dont want my plain user to run passwordless sudo commands so I need the password to run the nixos-rebuild switch. I feel the warning is targeted at users using password-based ssh ? which is not my case but I still get the warning. Also the password is asked right at the start of deploy-rs, I would prefer for it to be asked last second, right before doing the switch to avoid the process holding onto it.

amalgame21 commented 2 weeks ago

Ya I think sudo password, ssh key passphrase and ssh password authentication are different things. I don't know why I use ssh key with passphrase and sudo password with normal user, still get this warning message.