Securely making an SSH connection from a public computer

Question

Today, I had to remotely connect to my debian computer at home to fix an issue with a VPN server.

I was using my iPhone with an SSH client to fix the issue, but I had a hard time due to the small screen size and virtual keyboard. There was a public (Windows) computer at hand, and I figured I could use it to connect to my computer. It would have been great, but I suspected the computer of having a key logger, so my root password could be "recorded". Plus, being a Windows computer, the computer didn't have any SSH client installed, so I would have had to use an online SSH client (which could log my keyboard strokes as well).

Here is my question:

How would I go securing my debian computer, so that I don't have to worry that much the next time I need to ssh-connect from a public computer?

Answer 1

Why don't you make your debian computer to require only public and private keys instead of requiring for a password? You can change that setting on the sshd_config file. But before you do that you just have to generate the keys and install them on your server with ssh-copy-keys. After going through this process nobody would be able to even try to guess an user and password because the only way to access it is by having the key and if you want it even more secure you need to provide a passphrase when creating the keys. I do this also when I'm lazy and I don't want to type my password every time that I want to log into my server.

Answer 2

The biggest issue with public connections is the password. I don't really care if someone comes to know my username/what I did. What matters though, is how they could re-use my password.

I suggest securing SSH access with two-steps authentication. I found that link explaining how to enable Google Authenticator for your SSH login: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication

For those who don't know, here's a Wikipedia description of what it does:

Typically, users will install the Authenticator app on their smartphone. To log into a site or service that uses two-factor authentication, they provide user name and password to the site and run the Authenticator app which produces an additional six-digit one-time password. The user provides this to the site, the site checks it for correctness and authenticates the user.

1. First, install libpam-google-authenticator from your favorite package manager. Source code here
2. Enable two-step authentication by adding auth required pam_google_authenticator.so to your /etc/pam.d/sshd configuration page.
3. Make sure ChallengeResponseAuthentication is set to yes in your /etc/ssh/sshd_config file.
4. Log-in as the user for which you want two-steps authentication, run google-authenticator and follow the steps. It will even print out a nice QR-Code in your terminal for convenience
5. Restart your SSH server and try it out!

That way, you could create an account in the sudoers group that would only have Google Authenticator's password authentication. No static password, reliable, and still a root access.

But this solution assumes that key loggers are the only threats a public computer has to offer.