2

This question is more of a general Linux or OpenSSH question than it is specific to Ubuntu but because I'm setting up an Ubuntu server, I'm asking it here.

The organization I work for is built on an almost entirely Microsoft infrastructure. That said, I know enough Linux to be dangerous and I'm setting up an Ubuntu server to run Splunk. I'm trying to lock down the server and one of the things I would like to do is to use only public key authentication for SSH.

I know how to configure SSH to do this, but there is a challenge with regards to the various users' public keys and I imagine this challenge isn't unique to my situation.

The trouble is this... Let us say that another person on the Systems Administration team decides they need to log into this server in order to troubleshoot something. Since public key authentication is the only SSH authentication mechanism allowed, they can only log in via the console (where it will allow them to enter a password).

How can this person get their SSH public key loaded into their authorized_keys file without having to type it out manually after logging via the console? I imagine this question may have a procedural answer that is perfectly valid. If that is the case, please feel free to suggest a procedure that would be a valid solution to this problem as well.

Thanks in advance!

In case it matters, I'm also using PowerBroker Identity Services (PBIS) Open in order to leverage the ability to use Active Directory domain accounts on the server. If you sign in using a new (and authorized) account on a Linux server running PBIS Open, it automatically creates a profile for that person. Active Directory accounts do not need to be pre-created on the Linux server running PBIS Open before they can log in.

|improve this question
  • use ssh-copy-id to transfer the key, but they have to be able to log in. Your other option is to use a web based solution. – Panther Jun 8 '15 at 18:34
  • @user68186 - read closer "How can this person get their SSH public key loaded into their authorized_keys file without having to type it out manually after logging via the console? " - so what they are doing now is logging in and manually copying the key. Instead they should use ssh-copy-id ;) – Panther Jun 8 '15 at 18:47
  • @user68186 - could be, ask for clarification if you are not sure. Web interfaces also allow you to transfer keys ;) – Panther Jun 8 '15 at 19:07
  • @bodhi.zazen - Regarding ssh-copy-id, we have Windows desktops and are using PuTTY. This command seems to be for Linux workstations. – FinAckNinja Jun 8 '15 at 19:11
  • 1
    You have to transfer the key as a user that can log in via ssh. You can still use winscp to transfer the file(s) – Panther Jun 8 '15 at 19:33
1

Thanks for the feedback. I will list the proposed (and viable) solutions:

  • use the Hyper-V console instead of the VMM console to "type" the key automatically as if pasting
  • plug a USB drive into the Cisco UCS chassis and set up USB passthrough
  • have another person who can already log in handle the key for the new user
  • or temporarily allow password authentication so the new user can set up their key and then disable it again.
|improve this answer
  • @guntbert Yes, but if it's a valid answer (or several), that's fine, since the answers should (also) be given as answers and not (merely) comments. See "What should I do for comment answer". – Chai T. Rex Dec 2 '17 at 21:57
  • 1
    Other solution, the user puts the public key on a (preferably local) webserver and downloads it with wget. – fkraiem Dec 20 '17 at 10:17
  • Or put the public key at some accessible location. It doesn't need to be kept private. Download via any applicable protocol. Then all that's needed is curl http://example.com/authorized_hosts > .ssh/authorized_hosts. – vidarlo Dec 20 '17 at 11:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.