I have to provide some user support for a specific software. As providing support via email back-and-forth is tedious, I would like to get temporary access to the user's account.
Let's call the user I am giving support to Bob. Is the following procedure valid?
- Email Bob my public SSH key
id_rsa.pub - Then, Bob creates a back-up of
authorized_keys - Bob then adds my public SSH key to
authorized_keysviacat id_rsa.pub >> authorized_keys - I log-in via SSH as user Bob without the need to know Bob's password
- After I have finished troubleshooting and logged out, Bob reverts to his old
authorized_keys, thus revoking my SSH access
Side question: How can Bob monitor what I am doing? Since granting me access to his user account requires a lot of trust on Bob's part, transparency would likely boost acceptance of this measure.
For the sake of completeness, here is how I tested the procedure at home.
- I email Bob my public SSH key
id_rsa.pub - Bob adds
screen -x sharedto his.bashrc - Bob starts a screen session with
screen -d -m -S sharedand attaches to it - Then, Bob creates a back-up of
authorized_keys - Bob adds my public SSH key to
authorized_keysviacat id_rsa.pub >> authorized_keys - Bob informs me to get going
- I log-in via SSH as user Bob without the need to know Bob's password. I am automatically attached to the already running screen session, thus Bob can monitor my operations
- After I have finished troubleshooting and logged out, Bob reverts to his old
authorized_keys, thus revoking my SSH access - Bob can now close all screen sessions and remove the one line he added to his
.bashrc
Requirements on Bob's part:
- A running SSH server
- screen has to be installed
Both tools are available from your Linux distribution's package repositories. As communication is done directly between me and Bob I consider this solution superior to the TeamViewer approach mentioned in the comments. Furthermore, TeamViewer is not open source.
