I am setting up Amanda to backup a small network of Ubuntu 16.04 servers and desktops. Let's say U1 is the backup server and U2 is a client. Each has an account named "backup" without a login shell or password (created by default in Ubuntu). I want backup@U1 to SSH to backup@U2 using keys, not passwords. From what I understand, it is more secure if backup does not have a login or password, but can only be accessed by ssh keys.

I have generated the SSH keys and copied U1's public key to U2's backup home directory /var/backups/.ssh/authorized_keys (with backup as owner). I have also copied the U2's host key to U1 /var/backups/.ssh/known_hosts. When I try to ssh from U1 to U2

sudo -u backup ssh -i /etc/amanda/MyConfig/ssh-key U2.example.com

I get

This account is currently not available.

I can ssh from my account on U1 to another account on U2, so I know ssh is working between the two machines. From the message, I am guessing that the lack of a password/login on the backup account is the problem. How can I set this up securely so that Amanda can ssh to the clients to backup the network?

  • You can't log into an account without a valid shell. – psusi Feb 27 '18 at 1:53
  • That makes sense, but how can I change the account to allow login by ssh keys only (no password, either on the machine or ssh)? – Paul B Feb 27 '18 at 23:50

Create a user, lock the account, add SSH keys and you are done. If you lock the account’s password, the SSH keys will still work.

You need to at least have a username on the remote system’s to allow login. But that does not mean that user should have password access. So if you want to do this, let’s assume your backup username is backup; note this is a bad username since it is so common so come up with some 8 letter combo that works for you. Anyway, create the user like this:

sudo adduser backup

Okay, now just go trough the usual pile of questions you get when running adduser including setting a password.

Then when that user is created, just do this to lock the account:

sudo passwd -l backup

Now if you setup the SSH keys under that user’s account, you will be able to login via SSH but not via password login.

| improve this answer | |
  • So I should create a new regular user account rather than modifying the existing "backup" system account? – Paul B Feb 28 '18 at 0:41
  • @PaulB Yes. Create a new “backup” user for your needs. Like maybe backitup or backusr and use that. – Giacomo1968 Feb 28 '18 at 1:05
  • I setup a new backup user as above, but when I ssh, it asks for the new user's password. When I enter it, it says: Permission denied, please try again. – Paul B Feb 28 '18 at 16:26
  • @PaulB Did you add SSH keys to the user account? Does the .ssh directory have 700 permissions and does the .ssh/authorized_keys file have 600 permissions? – Giacomo1968 Feb 28 '18 at 17:12
  • 1
    I changed the name of the key files from ssh_key(.pub) to id_rsa(.pub) and now it works! – Paul B Feb 28 '18 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.