Groups > linux.debian.user > #202597

Re: ssh

From	Michael Howard <mike@dewberryfields.co.uk>
Newsgroups	linux.debian.user
Subject	Re: ssh
Date	2018-11-19 08:40 +0100
Message-ID	<wVMk1-7jV-3@gated-at.bofh.it> (permalink)
References	(4 earlier) <wUjaq-89C-3@gated-at.bofh.it> <wUtCN-6ov-7@gated-at.bofh.it> <wV0p3-1X6-1@gated-at.bofh.it> <wVtU6-3Qi-5@gated-at.bofh.it> <wVHNn-47a-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 19/11/2018 02:46, Alan Taylor wrote:
> Thanks Mike,
>
> I was slowly coming to that conclusion !
> What would be best practice regarding a password for that account 
> (i.e. system account such as backuppc that needs ssh access but no 
> shell access).
>
> If I create the user with bash as the shell, I seem to have a few options:
> 1) don’t set a password (i.e. no reference to password in the adduer 
> command). The man page says this results in the password being 
> “disabled”. What does this actually mean for security ?
> 2) use —disabled-password (same as 1 above ?)
> 3) the —disabled-password option appears to be only available on 
> debian. Redhat derivatives only offer useradd which does not have this 
> switch ?
>
> Which would be the most secure, while still allowing ssh access ?
>
>

Don't get too hung up on it all.

If the account needs login access then give it. Create or use an account 
with a shell of your choice and a secure password. You don't need to 
remember the password, as you are using keys, so it can be ridiculously 
secure. A standard user cant do much harm if you don't give it any more 
privileges than it needs.

-- 
Mike Howard

Thread

Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-13 04:30 +0100
  Re: ssh Alan Taylor <ataylor@ieee.org> - 2018-11-13 05:40 +0100
    Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-13 08:40 +0100
      Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-15 07:20 +0100
        Re: ssh David Christensen <dpchrist@holgerdanske.com> - 2018-11-15 18:30 +0100
          Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-17 05:30 +0100
            Re: ssh Michael Howard <mike@dewberryfields.co.uk> - 2018-11-18 13:00 +0100
              Re: ssh Alan Taylor <alan.james.taylor@gmail.com> - 2018-11-19 03:50 +0100
                Re: ssh Michael Howard <mike@dewberryfields.co.uk> - 2018-11-19 08:40 +0100
                Re: ssh john doe <johndoe65534@mail.com> - 2018-11-19 09:50 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-19 14:40 +0100
                Re: ssh Jim Popovitch <jim@k4vqc.com> - 2018-11-19 15:50 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-19 18:20 +0100
                Re: ssh Jim Popovitch <jim@k4vqc.com> - 2018-11-19 19:10 +0100
                Re: ssh Michael Stone <mstone@debian.org> - 2018-11-20 03:20 +0100
                Re: ssh Greg Wooledge <wooledg@eeg.ccf.org> - 2018-11-19 14:40 +0100

csiph-web