By the way, if you want to share your terminal ephemerally with someone over SSH, I swear by http://tmate.io/. It was something I desperately needed a solution for, and tmate delivers very very well.
One of these days I need to write a blog post on how to do it, but I pair program with my colleagues over ssh and tmux.
Briefly:
- Set up a guest account on your computer. Write a small script containing "tmux attach-session -S /tmp/guest-session -t guest". Make this shell script the login shell for the guest account (make sure you are patched against heartbleed ;-) )
- Create a guest group and add your user and the guest user to it
- Write a script for you that contains "tmux -S /tmp/guest-session -t guest new"
- Configure ssh for RSA login
- Whenever you want to work with someone, add their ssh key to the guest account's .ssh/authorized_keys. Then run your script to start the tmux session.
- They still won't be able to log in until you give read and write permissions to the tmux socket (which allows you to have some control over when people can log in). To allow them to log in: "sudo chgrp guest /tmp/guest-session"
Note that you still have to trust the person because they will be sharing your session. However, you will be able to see everything they are doing. When they ssh in, they will immediately join your tmux session (unfortunately without any notification -- need to see if there are some hooks you can use to notify when people attach to the session).
Having a shell script as a login shell is obviously a potential security hole, so you should make sure that authorized_keys only contains keys when you want people to log in.
There is a project somewhere that contains a lot of scripts for doing this kind of thing (I forget what it is called), but I think it is better to learn how to do it yourself ;-)
That's pretty much exactly what tmate does (it uses tmux under the hood). However, I was looking at how to do this myself and couldn't figure out how to share my session and only allow people into that, rather than the whole system, so thanks!
Just to add: tmux provides a read-only switch that guest (students, support, colleagues) won't interfere with the session, but can give advices/ask questions through another channel e.g. phone, irc, ...
They're two, really: One is when I want to collaborate with a friend on a project (we both use vim, so we work on the terminal), and I don't want to set up a new account and transfer all the files, set up the environment and give him free rein on it, and the other is to quickly debug some issue on a remote friend's computer while he can see what I'm doing and learn from it.
