I have to provide some user support for a specific software. As providing support via email back-and-forth is tedious, I would like to get temporary access to the user's account.
Let's call the user I am giving support to Bob. Is the following procedure valid?
- Email Bob my public SSH key
id_rsa.pub
- Then, Bob creates a back-up of
authorized_keys
- Bob then adds my public SSH key to
authorized_keys
viacat id_rsa.pub >> authorized_keys
- I log-in via SSH as user Bob without the need to know Bob's password
- After I have finished troubleshooting and logged out, Bob reverts to his old
authorized_keys
, thus revoking my SSH access
Side question: How can Bob monitor what I am doing? Since granting me access to his user account requires a lot of trust on Bob's part, transparency would likely boost acceptance of this measure.
For the sake of completeness, here is how I tested the procedure at home.
- I email Bob my public SSH key
id_rsa.pub
- Bob adds
screen -x shared
to his.bashrc
- Bob starts a screen session with
screen -d -m -S shared
and attaches to it - Then, Bob creates a back-up of
authorized_keys
- Bob adds my public SSH key to
authorized_keys
viacat id_rsa.pub >> authorized_keys
- Bob informs me to get going
- I log-in via SSH as user Bob without the need to know Bob's password. I am automatically attached to the already running screen session, thus Bob can monitor my operations
- After I have finished troubleshooting and logged out, Bob reverts to his old
authorized_keys
, thus revoking my SSH access - Bob can now close all screen sessions and remove the one line he added to his
.bashrc
Requirements on Bob's part:
- A running SSH server
- screen has to be installed
Both tools are available from your Linux distribution's package repositories. As communication is done directly between me and Bob I consider this solution superior to the TeamViewer approach mentioned in the comments. Furthermore, TeamViewer is not open source.