4

I wonder if there is a tool/modified ssh-server/ssh option which enables me to grant ssh access for a single session to a given user. What I want to avoid is creating a user account and password for the specific guest. It could instead use an existing user account with certain access rights to be set once. I do not want to share the same account information with everybody I grant access to. The access permission should either work only once/time out after a given interval or the tool should ask me if it detects an access whether I want to grant it. The idea is to share a line like 

ssh tempuser001@host

where tempuser001 is tells the server who tries to access but does not correspond to a real user. The user could use his temporary privileges to do all the fancy things you can with ssh connections, like scp, rsync, and whatever works through tunnels likevnc, ... The inspiration for this comes from teamviewer, a kind of vnc which permits a remote user to access my desktop once I shared an id with him.

Improve this question
  • What do want tempuser001 to see after they've logged in? Will your above ssh command leave them in an empty directory all their own, or in your home directory? Do you want the tempuser to have complete control over your account while logged in, or do you want them sandboxed into a limited environment? – Don Simon Apr 4 '13 at 20:52
4

One solution would be to use ssh keys for this.

You can specify a command to run whenever a certain ssh key is used to log into the server. By combining this with a simple login script you can get whatever access control you want.

Here is a quick example I whipped up which grants access until a certain date.

Add the user's ssh to the target user's authorized_keys file. In this example I add the date after which the user should no longer have access.

~/.ssh/authorized_keys

command="/etc/ssh/access.sh 2013-04-05" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc7nKsHpuC6WW8sBbf1j0snelmBsPAN5GQdJ86sJCyCsDzykvB2i2anLS/U131p0yDf0bU8W8kdsLE9pHQ5NLWlxlyWmFxdKujg4B+WxyHFKO0PHKfQhXEwMrYE4m9QwGYtsQrrWXBg4vQwUvOQDA4cNhdvNrIf/V+BGcdWtCXO/JGy7vkyKLd8LLHcZGsG3Pq5trHAKHaWkQgBN8P+atIX3FbwwQl4Ja020P7LW0ddPuUJxltOS11ZjdsG04s/xpL6JX3xi9FdDpO13SkQ5cqD0GIFkI+CLksqGYvvvpC7/22Rl4hc3nAcOIiwekylSB5rpU4LawF1IxCk0sg0BGr

And create the login script to be executed.

/etc/ssh/access.sh

#!/bin/bash

until="$1"

if (( $(date --date="$until" +%s) < $(date +%s) )); then
    echo "Your login has expired"
    exit
fi

exec ${SSH_ORIGINAL_COMMAND:--a -${SHELL##*/} $SHELL}

(don't forget to chmod a+x /etc/ssh/access.sh after creating it)

Once access has expired it'll look like this

PROMPT # ssh localhost
Your login has expired
Connection to localhost closed.
PROMPT #
Improve this answer
  • OpenSSH since version 6.2p1 supports AuthorizedKeysCommand option through which it can retrieve a key independently of the standard files. So you can send the private part of the key to the user and supply the public part to sshd through the command (it has to print it to its standard output). – peterph Apr 5 '13 at 7:40
  • 1
    @peterph in good security practices you shouldn't be sending private keys anywhere. Let the user just give you their own public key. (what does that have to do with AuthorizedKeysCommand anyway?) – phemmer Apr 5 '13 at 12:01
  • This solution does not completely block access after particular date because it is still possible to use ssh tunneling to the target machine for example (but without shell access). – Boris Bukh Jun 28 '18 at 9:11
2

Is Real one-time passwords (OTP) on Linux other than S/Key? (specifically S/Key, OPIE and OTPW) helpful?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.