Ask local user for confirmation before letting someone else log in via SSH

Question

I would like to know if there's a way to ask the local user (logged in via GUI) to confirm/deny any other authentication attempts, such as someone trying to log in via SSH?

The scenario is this, I may want to leave my SSH key on an user's machine to be able to debug or help them should things go wrong, but at the same time I want them to remain in control, so neither I nor someone having stolen my SSH key would be able to log in without at least a confirmation from the user (the user would expect me to tell them beforehand that I would log in, so if that didn't happen they reject the connection).

Is this possible? The machine in question is running Ubuntu 16.10, with the default Unity desktop environment.

Answer 1

Yes. That should be possible using custom PAM module in /etc/pam.d/sshd that would issue the prompt for the user using for example Zenity. But this QA is not a format to write you a whole script.

Answer 2

This is silly request but one could use a command pointing to a shell wrapper which would check for example for presence of a file, if the file is existing on the server than the session would not be end with 'exit' and allow shell with specified SSH_ORIGINAL_COMMAND.

But anyway... one can create two user accounts with same UID but different username. Thus for real user everything would work as usual, for a supporting guy, he would have /sbin/nologin as his default shell on the remote machine. If a support guy needs to login, remote machine administrator would change his shell to eg. bash and the session would work. Then the administrator can kick out the supporting guy and change his shell back to /sbin/nologin.