4

Is it possible to have a different password for SSH access than your user password.

I would like to have a strong password for remote SSH/SFTP access, while having a password that is fast to type on my user account.

4
  • 1
    What type of remote access are you referring to? SSH only or remote desktop?
    – ephsmith
    Aug 17, 2012 at 14:00
  • @ephsmith SSH. It is also tagged ssh so I thought people would figure it out :P
    – Tyilo
    Aug 17, 2012 at 14:10
  • Better to specify that in the body than just assuming so :)
    – Gerry
    Aug 17, 2012 at 14:11
  • @Tyilo, I saw the ssh tag. I wanted to know if this was excusively for ssh. Some solutions will work for one, but not the other.
    – ephsmith
    Aug 17, 2012 at 14:13

2 Answers 2

5

You can only have one password for one and the same account, but for SSH and SFTP you can however further restrict access to make it more secure.

One thing you can and should do if your SSH server is available to the public is disable password authentication altogether:

Edit /etc/sshd_config (requires root credentials) and uncomment the line:

#PasswordAuthentication no

Next uncomment and change the following directive to no.

#ChallengeResponseAuthentication yes

Now you can only authenticate with SSH keys and authenticating with passwords is disabled. To set up a public and private key I'd refer you to the following documentation.

Additionally you can also restrict which accounts can login over SSH and for example only allow one specific user (which can be different from your day-to-day account and can have a more secure password). You can do that right from the Sharing preference pane.

2

If you're looking for strong security over SSH, I recommend using key authentication. You have the option of assigning a password to a key. You can be the judge of how strong the password for your key needs to be. Remember, that a medium strength key password when the key yields stronger security than simple password authentication--assuming that you've properly secured your private key.

The basic process is:

  1. Generate a public / private key pair using ssh-keygen (see link above)
  2. Copy / Append your public key to ~/.ssh/authorized_keys on the remote host.

To copy your public key to the remote host painlessly, grab and run ssh-copy-id once you've generated your key pair.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .