Linux: Is it possible to use the ssh key pair instead or in addition to the root privileges?

I'm facing the problem of securing an embedded platform. All ssh hardening have been setup, including 2 factor authentication and login with ssh key pairs.

Now, the root and user passwords are ridiculous easy to crack, all you need is physical access to the device, leaving all measures and precautions redundant. My idea is to harden the root access with the same techniques as ssh.(hardening the sudo command and root access) However while it is a common problem across all embedded platforms, I can't find much information on this.

How do I tackle this?

I am not sure what exactly you are asking for so I'll take a guess and assume that you want to harden your sudo authentication.

If this is the case and sudo on your system supports PAM then have a look at pam_ssh_agent_auth for ssh public key authentication or at pam_sss_gss (which may require properly setup FreeIPA IdM).

Physical access cannot be completely defended. A sufficiently motivated person will reverse engineer the system to get access, up to disassembling it and reading off the hardware.

Make an attacker's task more difficult by replacing passwords with stronger authentication where possible.

SSH can be configured to remove password auth, both OpenSSH and dropbear implementations allow this.

Review what logins are possible locally, not over the network. Video out with USB in may enable login to a tty. Or, the hardware may provide a serial console.

On a Linux box with PAM libraries, authentication is customizable, via modules that can be combined in various ways.

• Allow for login or sudo U2F with hardware authenticators like Yubikey (pam_u2f)

• Allow one time password from a device (pam_google_authenticator or pam_oath)

• Authenticate based on ssh-agent (pam_ssh_agent_auth)

• Remove passwords as sufficient for authentication

• Prohibit root login, only allow root to a difficult to physically access serial port (pam_securetty)

• If you must have passwords, enforce a long length like 16 characters (pam_pwquality) and encourage use of phrases like with Diceware. Do not use "complexity" requirements, those are not user friendly.

That is an introduction to OS authentication, what about before? During boot is an example where physical access gets you in. Editing the kernel command in grub can get you a shell without credentials. Which while useful to recover from lost credentials, may not be desirable. Consider password protecting the boot loader.