1

I have 3 aws environments running ubuntu 14.4. I am devops so I have root access to every server. One time I logged into live instance instead of staging instance because of Ctrl+R and instance name being similar, and deleted important data. Fortunately I had backup, so i was able to recover immediately.

I would like to prevent this in future. Is there a way where I can get yes/no prompt when I try to login to live system? I know I can use banner but client side check would work best.

I am okay with any other suggestion to make sure that I get warned whenever I connect to live system.

3
  • 1
    first you should not have root but sudo access; second its easy - change background color of your terminal to red in production servers, or change promt color(you can do it in bashrc with if to differentiate between root and normal user - multicolor)
    – Drako
    May 19 '17 at 10:58
  • 1
    @Drako Thanks, First point is covered as SSH login is with ubuntu user and not root user. Root user ssh login is not allowed.
    – bitkot
    May 19 '17 at 11:00
  • Still the same applies. Are there regular users working on those servers using SSH? No? Just change it globally for the server. You could also include things in your user configuration to display a message or include an upfront banner on ssh login.
    – Seth
    May 19 '17 at 11:56
1

One interesting way of achieving this is to have 2 ssh keys, one for production servers and one for non-production.

Make sure the production one is encrypted with a passphase that is NOT saved. You can encrypt the other one if you wish, but if you don't it'll make it clearer that you're hitting a production server, as you must first decrypt your key before it can be used.

Another 'trick' you can use in newer versions of SSH is to require 2 forms of authentication, so a key AND a password - enable this only for production servers.

This is done in the sshd.conf

AuthenticationMethods "publickey,password" "publickey,keyboard-interactive"

I'd still take Drako's recommendation of changing the prompt colours - I do this on servers I administer to make it clear to me, at a glance who I'm logged in as, and which server I'm on.

1
  • 1
    I think having a keypair with passphrase would be the best option for me.
    – bitkot
    May 25 '17 at 12:31
0

Just in case here is the example of colored prompt:somewhere at the end of bashrc try this(it works on my rhel, but could work on ubuntu as well(don't have any around to test)):

RED="\[\033[40;0;31m\]"
GREEN="\[\033[40;0;32m\]"
CLEAR="\[\033[0m\]"
if [ $(id -u) -eq 0 ];
then
    PS1="$RED\u@\h: \W \$$CLEAR "
else
    PS1="$GREEN\u@\h: \W \$$CLEAR "
fi

this will differentiate prompt on production red for root and green for user

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.