Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A lot of times, I need to ssh from computers that are not mine, so for security reasons, I would like to be able to create an ssh key that expires after one log-in with it. Also, it would be helpful if I would be able to retrieve these from my web server by entering in a password. Not so sure about how well the web server aspect of this would work, because that would probably pose a whole new set of security risks, but even just being able to create one-time ssh keys would be helpful. If anyone can help with this, I would greatly appreciate it.

share|improve this question

2 Answers 2

So how do you make sure that the access to the web server is safe?

A one-time password system developed by Cambridge University: http://www.cl.cam.ac.uk/~mgk25/otpw.html

share|improve this answer

The idea is interesting and wouldn't take too long to implement. The service could generate an ordinary RSA or ECDSA key (using ssh-keygen or openssl), append the public part to authorized_keys (with an "auto-expire" comment), and your ~/.profile or sshrc could automatically clean up such keys upon logging in.

However, it would you give no advantage in security, since you still have to authenticate, this time to a website – using, presumably, the same username and plain-text password that you would have given to SSH...

Even if you use SSL to avoid transferring the password in plain-text, the website still remains a little less secure than direct SSH logins; you would have to obtain and periodically renew a verified SSL certificate in order to avoid MitM attacks, and it is not as easy as just carrying the SSH fingerprint in your pocket.)


Before you suggest that you could use some kind of OTP authentication for the website, I'll note that you can use OTP for SSH connections, too. In particular, Google Authenticator comes with a PAM module for your server and OTP generator apps for most popular mobile phones. Another service, Duo Security, uses a phone call to authenticate. Finally, standalone modules such as OPIE exist, too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.