Best practices/secure approach for accessing ssh server from semi-untrusted machines

Question

I often need access to my home ssh server while abroad on customers machines. At present my ssh server is set to use password authentication on a non standard port. It's convenient because I can just download putty/pscp, do what I need to do and be done. But I am concerned about the security risks.

I've considered only allowing pub/pri key authentication with a passphrase. But I don't really want to be copying my private key onto remote machines if that can be avoided.

Is there a better approach? Something that is more secure, but still reasonably convenient.

I had thought of setting up two ssh servers, one exposed to internet, the other only to the LAN. The public server would allow password authentication, but would otherwise be locked down to only allow ssh access to the internal server (through a forced command or something). The internal server would only allow ssh access via pub/pri key authentication that uses a passphrase. In theory it should work, but I wonder if there is a simpler way.

Answer 1

Check the opie-server for a one-time-password mechanism.
Here is one brief introduction.

Answer 2

If you are willing to spend some money you could get a yubikey and then use the Yubico PAM module. With this you can setup two-factor authentication. To login, it would require both your Yubikey and a password.

Answer 3

Get a USB thumb drive. Copy your public key onto there. As long as you're there, you might as well copy PuTTY, pscp, and pageant onto it as well so you don't have to download it several times.