What do you think proper architecture would be, given that ssh needs a capabilit...

accrual · 2026-02-11T01:08:03 1770772083

> ssh needs a capability to let root logins

One can disable root login via SSH in /etc/ssh/sshd_config. sshd also drops root priviledges once it's running IIRC.

I use use sudo or doas as a regular user once logged in.

spott · 2026-02-11T02:02:32 1770775352

Does ssh need to allow root logins?

Sshing as a regular user and then sudo to root works 95% of the time…

jmb99 · 2026-02-11T04:32:26 1770784346

How does SSH become an arbitrary user without effective root?

nine_k · 2026-02-11T06:26:27 1770791187

SSH should not become a different user; it should call something like `/bin/login` which uses PAM for authentication and is capable of starting user sessions.

charcircuit · 2026-02-11T01:17:42 1770772662

I think a proper architecture would not even have a root account. The server would just expose an authenticated endpoint that allows for configuration and updates to be pushed for it.

nine_k · 2026-02-11T01:20:27 1770772827

You are thinking 20 years ahead. In 1995 most servers were still pets, not cattle.