I would like to allow to first remote login via ssh using password for a new users. After that authentication should be restricted to public key. How to deal with that? I mean how to restrict second and next login to ssh-keys, but allow first with password.

  • 1
    What are you trying to accomplish? I'd guess this is for the initial keys exchange? – Sobrique Jul 9 '14 at 12:30
  • I want to increase the security of the system. During first login - key exchange, after that login only using keys. – Krzysztof Bzowski Jul 11 '14 at 7:02

You didn't specify which operating system you are running so I'll assume it's Linux.

Have a look at the OTPW package. It's available on most distributions and is relatively easy to set up.

Below are two tutorials which explain how to set it up:

  • I was thinking about linux. OTPW looks promising. Thank you – Krzysztof Bzowski Jul 10 '14 at 12:36

you could reset the password after the user logs in with some kind of /etc/profile or bashrc script.

Then you need to avoid, that the user can change his password again. You know the four PAM facilities auth, account, password, session? You would have to change the password facility so that the user can not change his password anymore.

If you do not want to use ssh-keys but rather run a scenario:

fist login: easy login with password 2nd/3rd login with increased security

you manage the complete scenario in the backend with something like privacyIDEA. There a user can have different authentication devices (like "password" or OTP token). And you can define how often such a device (like the password) can be used. So set the password-to-be-used-only-once and you are done. There is a howto for runnnig it with a server farm and ssh.

Kind regards Cornelius

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.