2

TL;DR: I want to have a simple password to unlock my computer with physical access and a complex password to connect over ssh. This, using the same account.

I'm looking for a solution to manage access to my computer. For someone who has physical access to my computer (like myself and a couple of my friends who will use it every once in a while), I would like to have simple and short password that keeps complete strangers out. However, I would like to have another complex password for the SSH server, because the SSH server will be available from the public internet from time to time and having a simple password would be to much of a security risk.

I have looked into passwordless authentication using ssh keys, but that's not what I'm looking for, because I want to be able to ssh into my computer from any device. (And as far as I understand, my computer should have a list of trusted ssh-keys.)

So ideally, I want to have a simple password to unlock my computer with physical access and a complex password to connect over ssh.

Improve this question

2 Answers 2

Reset to default
2

I think the real solution is to create a non-admin account which can be accessed via ssh (presumably the account you want to use via physical access will have sudo privileges). The ssh account should not really have anything or be able to do anything other than let a user log in. You can then sufrom that user to the actual account you want to use, which will give you an additional layer of security and better logging regarding who is accessing the system (or trying to)

Improve this answer
3
  • While not strictly relevant to the question at hand: I also suggest switching your ssh port away from 22 (or any well-known port). A high number up near 5000 is out of the way of many script kiddies and will drastically reduce the number of attempted logins you get
    – agentroadkill
    Dec 12, 2015 at 14:39
  • I like this solution! :) Any possibility to restrict all access for this ssh-account except for executing su?
    – Martijn Courteaux
    Dec 12, 2015 at 15:10
  • You can make it really as restricted as you want to. How hard you want to work to do that is up to you. Were it me, I'd just make sure it didn't have sudo access. You could go as far as restricting access to /usr/bin or changing the PATH, if you wanted to
    – agentroadkill
    Dec 12, 2015 at 15:56
1

Not exactly what you describe, but it should solve your problems. The tool is called "single packet authorization" and very nice implementation with description is fwknop.

If you have computer with IP accessible from the internet, it is really common to see many authentication tries on SSH and it is really handy to protect the service somehow. Hiding is a good approach. Fwknop will basically allow you to unlock the ssh port for specific address from your mobile phone (for example) and then you can connect using your relatively simple password without exposing it to the world.

If it is way too complicated you can always set up two users:

  • local:
    • with simple password
    • denied to log in remotely
  • remote:
    • complex password
    • allowed remote login using AllowUsers option in sshd_config

and set up sudo transition from the remote to the local (either automatically or manually) to get into the same "context" as with your local logins.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .