Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to allow to first remote login via ssh using password for a new users. After that authentication should be restricted to public key. How to deal with that? I mean how to restrict second and next login to ssh-keys, but allow first with password.

share|improve this question
1  
What are you trying to accomplish? I'd guess this is for the initial keys exchange? –  Sobrique Jul 9 at 12:30
    
I want to increase the security of the system. During first login - key exchange, after that login only using keys. –  Krzysztof Bzowski Jul 11 at 7:02

2 Answers 2

up vote 1 down vote accepted

You didn't specify which operating system you are running so I'll assume it's Linux.

Have a look at the OTPW package. It's available on most distributions and is relatively easy to set up.

Below are two tutorials which explain how to set it up:

share|improve this answer
    
I was thinking about linux. OTPW looks promising. Thank you –  Krzysztof Bzowski Jul 10 at 12:36

you could reset the password after the user logs in with some kind of /etc/profile or bashrc script.

Then you need to avoid, that the user can change his password again. You know the four PAM facilities auth, account, password, session? You would have to change the password facility so that the user can not change his password anymore.

If you do not want to use ssh-keys but rather run a scenario:

fist login: easy login with password 2nd/3rd login with increased security

you manage the complete scenario in the backend with something like privacyIDEA. There a user can have different authentication devices (like "password" or OTP token). And you can define how often such a device (like the password) can be used. So set the password-to-be-used-only-once and you are done. There is a howto for runnnig it with a server farm and ssh.

Kind regards Cornelius

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.