Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have that access to production environment given by my sysadmin, but I do not trust myself. The setup is with private/public keys.

I am looking for a way to make a manual operation before authorizing me to connect to that production environnement like retyping a password or manipulating some files. Anything that I have to do manually will do the job.

Do you have any suggesion?

(Oh, and I am running OS X)

share|improve this question
up vote 10 down vote accepted

If it isn't already, encrypt your private key, so that you have to type your passphrase when you connect. You can do this with:

openssl rsa -in <old key file> -out <new key file> -aes256

Once you've confirmed it works, delete the unencrypted version.

Also, Ensure that the user you're logging in as has minimal privilges over the production system. Don't log in as (or make frequent use of) root. Ask your sysadmin to set up sudo for any high-privilege commands you do want to run.

Finally, don't bother putting any custom hoops in your own way. Very quickly, you'll get so used to them, that you'll autonomically jump through them without actually doing the thinking that it was supposed to prompt. Far better to just take general care with what you're doing.

That said, as a useful visual clue, setting up the shell background or text to be a different clour can help you rememeber which system you're on.

share|improve this answer

Setting a passphrase on your private key would satisfy your requirements.

edit: Perhaps a passphrase on a second private key so you aren't as likely to use an SSH agent to cache the authorisation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.