Secure Grading
Few of my students are nefarious. But sometimes they do evil by accident. For this reason, I never run their code using my regular account. You know, the one that has access to my gradebooks, coding projects, email, network shares, and personal music collection. However, testing under a separate grader account is annoying: I have to migrate files from a network share, run their code, and then migrate the results back to my gradebook. I tried this approach for a while, but I grew tired of entering my password.
I thought, I’ll just give my grading account my public key:
ssh-keygen -t dsa
cat ~/.ssh/id_dsa.pub | ssh grader@localhost 'cat - >> .ssh/authorized_keys'
This almost works. I can ssh in to the grader account without a password. However, I can also ssh back into my personal account—without a password. I might as well grade under my personal account.
The problem is that the ssh-agent which holds my authentication is sent along to the grader when I ssh in. When I ssh back into my personal account, the forwarded agent gives the okay.
The fix is simple enough. Disable agent-forwarding:
ssh -a grader@localhost
Now I’ve got one-way user-based authentication. My personal account can freely enter the grader account, but the grader account must enter a password to get back to my personal account.