SSH和会话使用不同的密码（KDE，Gnome等）

Question

I'm use an Debian based OS here on my work an i've configured the service for test routines of ERP app...

This service (Tomcat+Java service) it's consumed via HTTP on intranet correctly...but the test leader sometimes need chance the database used by service application and uses SSH to access my machine to change database on config file and restart the service...eventually this person change some service or OS config throwing problems to me (on my OS and others things..).

What i want know is if can i change my password only for SSH service (doesn't change to my KDE/Gnome session), just because the company's policy requires everyone to have a default password on stations...

Remebering that i'm a manager of config, maintenance and others jobs of service to test team...and change database solicitations can made to me.

A simple example:

KDE login if user 'carlos' and password '123456'

SSH login if user 'carlos' and password '4nyJokeHere'

That it's possible ?

Thanks in advance.

Answer 1

Possible? Maybe. You'd probably have to fiddle with pam.d to get SSH authenticating via a different mechanism to KDE etc.

Coming from a different angle, I may be missing something, can you not create a second user for the SSH process, keeping your main user for KDE etc cleanly separate?

I'd really strongly recommend trying to "split" a user into multiple purposes/security groups with differing passwords for each!

You can use authorized_keys to restrict the SSH commands available, and/or sudo...

Update: Some expansion on the subject as requested by the OP

You can limit commands available via SSH by using ~/.ssh/authorised_keys file - see O'Reilly for a good explanation .

Answer 2

I'm was solved this case applying a single rule here. On SSH service i'm was locked access of my user 'carlos --> sudoers' and enable access only for a user called 'padrao' (padrao translated to english is 'default').

This user 'padrao' doesn't have sudoers permissions. If i needed access with SSH my machine i'm do:

ssh padrao@my.intranet.machine
password: ***

$ su carlos
password: ***

This is not the best way to solve, but solved my problem here.

Thanks.