The .ssh/authorized_keys
file can be used to enable password-less login. In conjunction with the command
option, it can be used to restrict such logins to given commands. For example:
command="gitosis-serve joey@dulcimer",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAA...
This means if I have the private key corresponding to this public key, I can log in without a password, but all I get to do is execute gitosis-serve joey@dulcimer
.
How do I allow anyone to log in, but with similar restrictions?
Ideas:
Just host a telnet server. The problem is, it's not encrypted.
Set a trivial password (e.g.
password
). This would work, but how would I setcommand
, etc. ?Distribute the private key corresponding to the public key in
authorized_keys
. This would work, but I doubt it's secure. Couldn't Mallory use the private key to decrypt data sent to Alice during handshaking?