I have a bunch of Raspberry PI 3 devices running Linux, which are shared among multiple engineers. For the sake of simplicity, each Linux box has the same default username/password (i.e. everyone logs in as root) to test software we develop. This is a hard requirement (i.e. can't change this).
On occasion, two users (usually one working in the office, and another remotely via VPN) will log in to the same device at the same time, and the two users can cause issues for each other if both are running software that attempts to gain exclusive access to hardware connected to the box. Additionally, sometimes a user will reboot the system, which really annoys the other developer. While we try to implement schedules for exclusive access, these are often ignored when someone "just needs to get a quick check done".
Is there a way, on-demand (i.e. I don't always want this "feature" enabled), for a user to reserve the use of an account (i.e. root) for interactive/non-interactive SSH logons, so that only the IP address (i.e.
SSH_CLIENT) associated with that individual can be used? For example, let's say Bob and Alice both want to login to host
darkstar with username
root. Bob logs in first, and his IP address is
192.168.1.100. Bob wants exclusive access to
darkstar for 10 minutes, so he executes a special command (i.e.
bash /opt/mine_for_10_mins.sh), and for those 10 minutes:
- Bob can create additional interactive/non-interactive SSH instances (i.e. login via
sftp, etc.), so long as it's from the same source IP address of
192.168.1.100(or whatever is stored in
- Alice, who is attempting to login from IP
10.10.0.200is unable to login until the 10 minute period has elapsed, or Bob logs out. I'd ideally like to have both, and set an upper limit, so Bob can't just reserve a box for 48 hours, leave for the weekend, and leave people unable to login: if Bob logs out early, great; but he can't reserve for more than 10 minutes (or maybe 12 hours) at a time.
Ideally, I'd like to either accomplish this with a timer, or if it's too impractical/difficult, I'd like the "reservation" to end when Bob terminates all his login sessions from
Work So Far
I've tried playing with
/etc/nologin, but I couldn't find a way to guarantee it would be auto-deleted, and if our engineers are working remotely (flexible work-from-home setup), I don't want everyone locked out of the boxes unless someone comes in to fix the device remotely (though we are looking into a network-enabled KVM to remedy this).
There's also the possibility of running a script that periodically (i.e. every 5 seconds) auto-boots other users from other IPs by slaying off their
sshd instances, but I'd like to try and prevent logins entirely, as it's quite common for people to run non-interactive
ssh sessions with scripts that can interfere with other users on the same Linux box, and a polling-based approach wouldn't prevent that.