3

I have a user account on my server to which i access through ssh key authentication. I want to give a temporary access to that account to a third person. I was planning to create a password as an alternative authentication method (hence the server will be accessible either by password or by ssh key), give it to that third person for her to perform a job, and then delete the password once the job is done.

How can i create (and then delete) such a password?

|improve this question
  • 7
    Is there something restraining you from simply creating a new account for this person? User accounts should be personal. – maulinglawns Oct 29 '17 at 17:04
  • 1
    I think it would be much better to just add another public key to authorized_keys. – kasperd Oct 29 '17 at 22:45
10

The answer to the password question is:

  • Edit the /etc/ssh/sshd_config file to ensure that passwords are enabled.
PasswordAuthentication yes 
PermitEmptyPasswords no

Then restart the ssh service (HT - @tonioc). This will work for sysvinit systems:

/etc/init.d/ssh restart

And this should work for systemd systems:

systemctl restart ssh

And then either:

  • Login with your key and change the passwd of the account if the password is locked.

Or (better):

  • Add a new user account for the new user and add that user to whatever minimum groups are required to accomplish the new user's task.

Or (even better):

  • Add a new user and have them give you a public key
  • Add their key to their ~/.ssh/authorized_keys file if they don't know how to copy it themselves.

However, for the least number of changes but rather poor security, you can simply add another key to:

~/.ssh/authorized_keys

on the server.

You can have as many keys as you want in the authorized_keys file. It's one key per line with options prepended.

There are many options that can be added to the authorized_keys file.

See here

And/or:

man authorized_keys

Of course, as others have pointed out, it's not a good idea to have more than one user per account unless it's run by a team. Temporary privileged access or accounts are probably not a good idea.

|improve this answer
  • 1
    But don't forget to delete it afterwards. – NickD Oct 29 '17 at 17:06
  • 1
    @Nick ... well, yeah... but if the account is the same, then there's nothing stopping the 2nd authorized user from modifying the account. I didn't comment on the "goodness" of the idea -- which isn't too good. If I were to advise on a plan, I would say "add a new unprivileged account," but I don't know the purpose of the 2nd user login. – RubberStamp Oct 29 '17 at 17:10
  • @RubberStamp Thx for your answer - but how to create a password instead of a second ssh key? – jim basquiat Oct 29 '17 at 17:19
  • @jimbasquiat: Now I see what you mean. – RubberStamp Oct 29 '17 at 17:33
  • @RubberStamp thx a lot - last question where is the sshd_config located? – jim basquiat Oct 29 '17 at 17:33
4

1) in sshd_config, add PasswordAuthentication method for this user: 

Match User <thisusername>
  PasswordAuthentication yes

then restart sshd service.

2) set the password for this user using (as root or with sudo):

passwd <thisusername>

once job is done, change PasswordAuthentication to no in sshd_config, and (optionally) change password using passwd again.

|improve this answer
  • thx - how would you restart the ssh service? – jim basquiat Oct 29 '17 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.