0

Unfortunately, not all (client) software that supports SSH/SFTP supports publickey authentication.

How would one set up a standard Ubuntu desktop (with sshd enabled) so that you could use an easy password to login locally, but need a different (more secure) password to login to the same account via SSH?

I would prefer to remain able to login to the desktop user via publickey auth, for those programs that do support it.

  • only way I'm aware of requires a FreeIPA domain and hbac – Jacob Evans Apr 11 '17 at 12:01
  • 1
    Use an SSH key and encrypt the key with the "easy" password. – TheFiddlerWins Apr 11 '17 at 19:58
  • @TheFiddlerWins That doesn't work, because the apps I'm talking about simply do not support publickey auth. They literally have 'host', 'port', 'username', 'password'. I'd like to use a secure password there, and an easy password for local logins to the same user. – Someone Somewhere Apr 12 '17 at 10:41
0

Have another user for SSH Login and use sudo

or su - if need to Access the Desktop-User Profile.

Disable the Desktop-User in /etc/ssh/sshd_conf with "DenyUsers":

/etc/ssh/sshd_config:

...

DenyUsers Desktop-User

...

  • This would prevent logging in to the desktop user with publickey auth, correct? I'd rather avoid that if possible. – Someone Somewhere Apr 11 '17 at 11:56
0

I don't know if I understand your request but if I understand right, you need a user who can log in to the server locally and via SSH but with different passwords?

If that is the case, simply create an SSH keypair with a different password and allow remote login with SSH keypair. In /etc/ssh/sshd_config find the line: PasswordAuthentication. Set this to no. From this point the users will be able to log in to your server via SSH if they have a private key available on their client, and they will have to enter the SSH keys passphrase instead the users password that you use to log in locally.

  • As I've said, lots of clients simply do not support logins using keypairs, and using a different third party app to connect isn't so feasible on mobile. – Someone Somewhere Apr 12 '17 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.