4

I have a user account on my server to which i access through ssh key authentication. I want to give a temporary access to that account to a third person. I was planning to create a password as an alternative authentication method (hence the server will be accessible either by password or by ssh key), give it to that third person for her to perform a job, and then delete the password once the job is done.

How can i create (and then delete) such a password?

2
  • 7
    Is there something restraining you from simply creating a new account for this person? User accounts should be personal.
    – anon
    Oct 29, 2017 at 17:04
  • 1
    I think it would be much better to just add another public key to authorized_keys.
    – kasperd
    Oct 29, 2017 at 22:45

2 Answers 2

11

The answer to the password question is:

  • Edit the /etc/ssh/sshd_config file to ensure that passwords are enabled.

PasswordAuthentication yes 
PermitEmptyPasswords no

Then restart the ssh service (HT - @tonioc). This will work for sysvinit systems:

/etc/init.d/ssh restart

And this should work for systemd systems:

systemctl restart ssh

And then either:

  • Login with your key and change the passwd of the account if the password is locked.

Or (better):

  • Add a new user account for the new user and add that user to whatever minimum groups are required to accomplish the new user's task.

Or (even better):

  • Add a new user and have them give you a public key
  • Add their key to their ~/.ssh/authorized_keys file if they don't know how to copy it themselves.

However, for the least number of changes but rather poor security, you can simply add another key to:

~/.ssh/authorized_keys

on the server.

You can have as many keys as you want in the authorized_keys file. It's one key per line with options prepended.

There are many options that can be added to the authorized_keys file.

See here

And/or:

man authorized_keys

Of course, as others have pointed out, it's not a good idea to have more than one user per account unless it's run by a team. Temporary privileged access or accounts are probably not a good idea.

7
  • 1
    But don't forget to delete it afterwards.
    – NickD
    Oct 29, 2017 at 17:06
  • 1
    @Nick ... well, yeah... but if the account is the same, then there's nothing stopping the 2nd authorized user from modifying the account. I didn't comment on the "goodness" of the idea -- which isn't too good. If I were to advise on a plan, I would say "add a new unprivileged account," but I don't know the purpose of the 2nd user login. Oct 29, 2017 at 17:10
  • @RubberStamp Thx for your answer - but how to create a password instead of a second ssh key?
    – jim jarnac
    Oct 29, 2017 at 17:19
  • @jimbasquiat: Now I see what you mean. Oct 29, 2017 at 17:33
  • @RubberStamp thx a lot - last question where is the sshd_config located?
    – jim jarnac
    Oct 29, 2017 at 17:33
5

1) in sshd_config, add PasswordAuthentication method for this user:

Match User <thisusername>
  PasswordAuthentication yes

then restart sshd service.

2) set the password for this user using (as root or with sudo):

passwd <thisusername>

once job is done, change PasswordAuthentication to no in sshd_config, and (optionally) change password using passwd again.

1
  • thx - how would you restart the ssh service?
    – jim jarnac
    Oct 29, 2017 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .