1

I want to set up two factor authentication on a server, on witch I don't have administrative account. The purpose of this is: I want to give some other people possibility to create SSH tunnels to this server (through my account) , but I do not want them to have shell access.

The only clue I've found so far is to create custom .bash_profile script which asks for second password much like in this question:

https://unix.stackexchange.com/questions/179538/bashrc-custom-secondary-password-and-scp-is-not-working-ssh-secondary-passwor

However it is useless, as it is still possible to login through sftp and remove the script.

So is it even possible to do this without superuser privileges?

1 Answer 1

0

You have mixed up terminology in your question. First you ask for two factor authentication. Next you proceed to explain your needs, which are not at all related to two factor authentication. Two factor authentication in itself doesn't impose any limitations on what the user can do once authenticated.

Imposing limitations on what can be done with an ssh login is possible, as long as a public key is used for authentication.

In ~/.ssh/authorized_keys, you can impose limitations on what each key specified in that file can be used for. For example if you don't want to permit shell access, you can force a command, which does nothing:

command="/bin/false" ssh-rsa ...

The key on that line won't have access to neither shell nor sftp. It can still be used for port forwarding, as long as the -N flag is used on the client side. There are many other limitations possible. For a full list of the limitations you can impose on key usage, see the sshd man page.

1
  • By "two factor authentication" I meant: First stage login - you are connected to server but cannot do anything except tunneling. Second stage - you have full access to shell. Sorry if I used wrong terminology. Setting this aside Your solution is even better! Thank you for your help.
    – Shyman
    Jan 22, 2015 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .