I would like to know if there's a way to ask the local user (logged in via GUI) to confirm/deny any other authentication attempts, such as someone trying to log in via SSH?

The scenario is this, I may want to leave my SSH key on an user's machine to be able to debug or help them should things go wrong, but at the same time I want them to remain in control, so neither I nor someone having stolen my SSH key would be able to log in without at least a confirmation from the user (the user would expect me to tell them beforehand that I would log in, so if that didn't happen they reject the connection).

Is this possible? The machine in question is running Ubuntu 16.10, with the default Unity desktop environment.

  • Look at the manpage of sshd, regarding SSHRC. Maybe this could be a way to go.
    – ridgy
    Mar 9 '17 at 16:32

Yes. That should be possible using custom PAM module in /etc/pam.d/sshd that would issue the prompt for the user using for example Zenity. But this QA is not a format to write you a whole script.

  • Sure, I'm definitely not asking for someone to write an entire module, I was just wondering if there is an easier way or if it's been done already. Mar 9 '17 at 14:40
  • The basic idea what is needed is in the answer and if something similar already exists, it would be more appropriate in the software recommendations.
    – Jakuje
    Mar 9 '17 at 14:41

This is silly request but one could use a command pointing to a shell wrapper which would check for example for presence of a file, if the file is existing on the server than the session would not be end with 'exit' and allow shell with specified SSH_ORIGINAL_COMMAND.

But anyway... one can create two user accounts with same UID but different username. Thus for real user everything would work as usual, for a supporting guy, he would have /sbin/nologin as his default shell on the remote machine. If a support guy needs to login, remote machine administrator would change his shell to eg. bash and the session would work. Then the administrator can kick out the supporting guy and change his shell back to /sbin/nologin.

  • Both accounts with same UID could use different ssh keys of course. And only local account could use for example sudo to run chsh.
    – Jiri B
    Feb 5 '19 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.