2

I have to provide some user support for a specific software. As providing support via email back-and-forth is tedious, I would like to get temporary access to the user's account.

Let's call the user I am giving support to Bob. Is the following procedure valid?

  • Email Bob my public SSH key id_rsa.pub
  • Then, Bob creates a back-up of authorized_keys
  • Bob then adds my public SSH key to authorized_keys via cat id_rsa.pub >> authorized_keys
  • I log-in via SSH as user Bob without the need to know Bob's password
  • After I have finished troubleshooting and logged out, Bob reverts to his old authorized_keys, thus revoking my SSH access

Side question: How can Bob monitor what I am doing? Since granting me access to his user account requires a lot of trust on Bob's part, transparency would likely boost acceptance of this measure.


For the sake of completeness, here is how I tested the procedure at home.

  • I email Bob my public SSH key id_rsa.pub
  • Bob adds screen -x shared to his .bashrc
  • Bob starts a screen session with screen -d -m -S shared and attaches to it
  • Then, Bob creates a back-up of authorized_keys
  • Bob adds my public SSH key to authorized_keys via cat id_rsa.pub >> authorized_keys
  • Bob informs me to get going
  • I log-in via SSH as user Bob without the need to know Bob's password. I am automatically attached to the already running screen session, thus Bob can monitor my operations
  • After I have finished troubleshooting and logged out, Bob reverts to his old authorized_keys, thus revoking my SSH access
  • Bob can now close all screen sessions and remove the one line he added to his .bashrc

Requirements on Bob's part:

  • A running SSH server
  • screen has to be installed

Both tools are available from your Linux distribution's package repositories. As communication is done directly between me and Bob I consider this solution superior to the TeamViewer approach mentioned in the comments. Furthermore, TeamViewer is not open source.

  • there are tools like team viewer that allow sharing of screen/shell. 1) bob start TV, 2) bob send id 3) you connect 4) bob see what you are doing. – Archemar Mar 30 '17 at 13:32
  • 1
    Why not 1) Bob changes their password to a temporary one. 2) you log in with that password and fix stuff. 3) You log out and Bob changes their password to previous/new password again? – Mioriin Mar 30 '17 at 13:35
  • 1
    @Mioriin because passwords are insecure. Using keys is recommended everywhere. – Jakuje Mar 30 '17 at 13:40
  • I have edited the order of operations, because the keys must be copied AFTER attaching to the screen session, to avoid leaving an unmonitored window. – Bruno9779 Mar 31 '17 at 4:14
2

The procedure is fine. Bob can either edit your key out or restore the backup. Consider the possibility that ~/.ssh/authorized_keys does not exist.

To monitor what someone is doing in the shell I would use screen.

  1. Bob adds screen -R to .bashrc
  2. You land in a screen session when logging in. Bob can see everything you type in the screen session.

(I am remembering the screen commands by hearth and some more config or test is probably needed. Check this documentation out http://wiki.networksecuritytoolkit.org/index.php/HowTo_Share_A_Terminal_Session_Using_Screen)

  • Good tip regarding screen, I have to check this one out. – Dohn Joe Mar 30 '17 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.