The biggest issue with public connections is the password. I don't really care if someone comes to know my username/what I did. What matters though, is how they could re-use my password.
I suggest securing SSH access with two-steps authentication. I found that link explaining how to enable Google Authenticator for your SSH login: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-two-factor-authentication
For those who don't know, here's a Wikipedia description of what it does:
Typically, users will install the Authenticator app on their smartphone. To log into a site or service that uses two-factor authentication, they provide user name and password to the site and run the Authenticator app which produces an additional six-digit one-time password. The user provides this to the site, the site checks it for correctness and authenticates the user.
- First, install
libpam-google-authenticator
from your favorite package manager. Source code here
- Enable two-step authentication by adding
auth required pam_google_authenticator.so
to your /etc/pam.d/sshd
configuration page.
- Make sure
ChallengeResponseAuthentication
is set to yes
in your /etc/ssh/sshd_config
file.
- Log-in as the user for which you want two-steps authentication, run
google-authenticator
and follow the steps. It will even print out a nice QR-Code in your terminal for convenience
- Restart your SSH server and try it out!
That way, you could create an account in the sudoers
group that would only have Google Authenticator's password authentication. No static password, reliable, and still a root access.
But this solution assumes that key loggers are the only threats a public computer has to offer.