How do all,

I just had a cool idea for strengthening SSH logins without resorting to key-based logins:

DISCLAIMER: I haven't researched this nor do I know if someone's had this idea before, I could very well be the last person to think of this, not the first. Not only that but it could also just be an all around crappy idea

Setup SSH to accept password logins. After a successful password login somehow trap the user/shell and present them with another login. This login would consist of another random password that was just generated on the fly and is sent via text message to a pre-defined cellphone number (maybe even one specific to whichever user you logged in as). After you've received the second, and one off, login via cellphone you enter it and login.

I was just thinking of a way to allow myself SSH access from various locations to my server without having to carry around my private key and also without going with only password protection.

This really isn't overly bright or unique as plenty of places have instituted similar two-factor authentication systems - I just wouldn't want to have to purchase one of those cool little random number login generators (if you've seen them you know what I mean).

Anyhow, what does LQ think? Do-able? Already done? Poor idea?

Enjoy

yeah it's doable. you can run it at a simple level i guess by having one users login shell be an su or ssh (locally or remote) or similar, so you log in to one user account and then directly be sent to another login. the OTP could be sorted with chpasswd i guess... all scriptable at a basic level, but might benefit from a more dedicated coding project.

this is a scenario already in use by various systems, but i've only seen it as a backup for more conventional key fob things. so yeah... give it a go i'd say.

I can recall a discussion about such two-way auth scheme and one of the milestones was about cell networks productivity/durability/availability. If you've got urself a dedicated sms gateway, whereas the provider guarantees your successful sms delivery - that's fine. If u're using web/online sms sending - i wouldn't rely too much on that...

and of course the other day i had an sms take 4 hours to get through...