Background
I have a bunch of Raspberry PI 3 devices running Linux, which are shared among multiple engineers. For the sake of simplicity, each Linux box has the same default username/password (i.e. everyone logs in as root) to test software we develop. This is a hard requirement (i.e. can't change this).
Problem
On occasion, two users (usually one working in the office, and another remotely via VPN) will log in to the same device at the same time, and the two users can cause issues for each other if both are running software that attempts to gain exclusive access to hardware connected to the box. Additionally, sometimes a user will reboot the system, which really annoys the other developer. While we try to implement schedules for exclusive access, these are often ignored when someone "just needs to get a quick check done".
Question
Is there a way, on-demand (i.e. I don't always want this "feature" enabled), for a user to reserve the use of an account (i.e. root) for interactive/non-interactive SSH logons, so that only the IP address (i.e. SSH_CLIENT
) associated with that individual can be used? For example, let's say Bob and Alice both want to login to host darkstar
with username root
. Bob logs in first, and his IP address is 192.168.1.100
. Bob wants exclusive access to darkstar
for 10 minutes, so he executes a special command (i.e. bash /opt/mine_for_10_mins.sh
), and for those 10 minutes:
- Bob can create additional interactive/non-interactive SSH instances (i.e. login via
ssh
,scp
,sftp
, etc.), so long as it's from the same source IP address of192.168.1.100
(or whatever is stored inSSH_CLIENT
). - Alice, who is attempting to login from IP
10.10.0.200
is unable to login until the 10 minute period has elapsed, or Bob logs out. I'd ideally like to have both, and set an upper limit, so Bob can't just reserve a box for 48 hours, leave for the weekend, and leave people unable to login: if Bob logs out early, great; but he can't reserve for more than 10 minutes (or maybe 12 hours) at a time.
Ideally, I'd like to either accomplish this with a timer, or if it's too impractical/difficult, I'd like the "reservation" to end when Bob terminates all his login sessions from 192.168.1.100
.
Work So Far
I've tried playing with touch
'ing /etc/nologin
, but I couldn't find a way to guarantee it would be auto-deleted, and if our engineers are working remotely (flexible work-from-home setup), I don't want everyone locked out of the boxes unless someone comes in to fix the device remotely (though we are looking into a network-enabled KVM to remedy this).
There's also the possibility of running a script that periodically (i.e. every 5 seconds) auto-boots other users from other IPs by slaying off their sshd
instances, but I'd like to try and prevent logins entirely, as it's quite common for people to run non-interactive ssh
sessions with scripts that can interfere with other users on the same Linux box, and a polling-based approach wouldn't prevent that.
Thank you.
ssh
etc) out of the box. You can also do this via SSH'ssshd_config
file creating matching sets that allow specific IPs + username combinations in. This method requires restarts tosshd
.