A lot of times, I need to ssh from computers that are not mine, so for security reasons, I would like to be able to create an ssh key that expires after one log-in with it. Also, it would be helpful if I would be able to retrieve these from my web server by entering in a password. Not so sure about how well the web server aspect of this would work, because that would probably pose a whole new set of security risks, but even just being able to create one-time ssh keys would be helpful. If anyone can help with this, I would greatly appreciate it.
So how do you make sure that the access to the web server is safe?
A one-time password system developed by Cambridge University: http://www.cl.cam.ac.uk/~mgk25/otpw.html
The idea is interesting and wouldn't take too long to implement. The service could generate an ordinary RSA or ECDSA key (using
However, it would you give no advantage in security, since you still have to authenticate, this time to a website – using, presumably, the same username and plain-text password that you would have given to SSH...
Even if you use SSL to avoid transferring the password in plain-text, the website still remains a little less secure than direct SSH logins; you would have to obtain and periodically renew a verified SSL certificate in order to avoid MitM attacks, and it is not as easy as just carrying the SSH fingerprint in your pocket.)
Before you suggest that you could use some kind of OTP authentication for the website, I'll note that you can use OTP for SSH connections, too. In particular, Google Authenticator comes with a PAM module for your server and OTP generator apps for most popular mobile phones. Another service, Duo Security, uses a phone call to authenticate. Finally, standalone modules such as OPIE exist, too.