Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The .ssh/authorized_keys file can be used to enable password-less login. In conjunction with the command option, it can be used to restrict such logins to given commands. For example:

command="gitosis-serve joey@dulcimer",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAA...

This means if I have the private key corresponding to this public key, I can log in without a password, but all I get to do is execute gitosis-serve joey@dulcimer.

How do I allow anyone to log in, but with similar restrictions?

Ideas:

  • Just host a telnet server. The problem is, it's not encrypted.

  • Set a trivial password (e.g. password). This would work, but how would I set command, etc. ?

  • Distribute the private key corresponding to the public key in authorized_keys. This would work, but I doubt it's secure. Couldn't Mallory use the private key to decrypt data sent to Alice during handshaking?

share|improve this question

2 Answers 2

Create a user group and give separate username and a password to use ssh access.
Publishing the private key is not a good thing.
Or else if you can create a python script including the private & public key to login to SSH and distribute the compiled version (ssh_login.pyc or any other comparable language) hope it will work.

share|improve this answer

The standard way to do this is to publically distribute the private key. I saw it used a lot "back in the day" when people didn't want to deal with the horrors of anonymous pserver CVS access. It's not insecure in the way you suggest, because SSH doesn't use the client's keypair for anything other than authentication; for the actual traffic encryption, a session key is negotiated and that is used to secure the communications.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.