Re: HowTo Disable execution of commands whit ssh and scp/sftp

From: Dmitry Surovtsev (sd_at_buc.com.ua)
Date: 03/24/04

  • Next message: Chris Callahan: "PAM issues with 3.7p and 3.8p" 
    Date: Wed, 24 Mar 2004 13:35:05 +0000
To: secureshell@securityfocus.com

    Very nice, but I'd add the TRAP command at the beginning...

    Dario Lesca wrote:

    >Hi, i am not subsribe to ML, but I have a simple question, if I must
    >subscribe to ML for post, I will do it.
    >
    >My question:
    >
    >Howto allow only the execution of one procedure via ssh an disable the
    >execution of any other command and the scp/sftp service?
    >
    >OK; ssh user@host
    >NO: ssh user@host cat /etc/passwd
    >NO: scp user@host:/etc/passwd /tmp
    >NO: sftp user@host
    >
    >I have found this solution, is a bad solution or not?
    >
    >The target (for example) is assign to remote generic user the
    >possibility to run a single command (setup, or another), and only that
    >one!
    >
    >[root@igloo root]# cat /usr/local/bin/ssh.sh
    >#!/bin/bash
    >echo $0 $*
    >export DISPLAY=
    >exec /usr/bin/setup
    >[root@igloo root]# chmod 755 /usr/local/bin/ssh.sh
    >[root@igloo root]# useradd -s /usr/local/bin/ssh.sh sshuser
    >[root@igloo root]# passwd sshuser
    >
    >Now Test all the metod
    >
    >
    >
    >>>OK; ssh user@host
    >>>
    >>>
    >[root@igloo root]# ssh sshuser@localhost
    >sshuser@localhost's password:
    >/usr/local/bin/ssh.sh
    >You are attempting to run "setup" which requires administrative
    >privileges, but more information is needed in order to do so.
    >Password for root:<CTRL C>
    >Connection to localhost closed.
    >[root@igloo root]#
    >
    >Ok, the command run propertly! ...
    >... via sudo then I can disable the password request ...
    >
    >Now test other case ... I do not want that these work ....
    >
    >
    >
    >>>NO: ssh user@host cat /etc/passwd
    >>>
    >>>
    >[root@igloo root]# ssh sshuser@localhost cat /etc/passwd
    >sshuser@localhost's password:
    >/usr/local/bin/ssh.sh -c cat /etc/passwd
    >[root@igloo root]#
    >
    >NOT WORK! good!
    >
    >
    >
    >>>NO: scp user@host:/etc/passwd .
    >>>
    >>>
    >[root@igloo root]# scp sshuser@localhost:/etc/passwd .
    >sshuser@localhost's password:
    >/usr/local/bin/ssh.sh -c scp -f /etc/passwd
    >[root@igloo root]# ls passwd
    >ls: passwd: No such file or directory
    >[root@igloo root]#
    >
    >NOT WORK! good!
    >
    >
    >
    >>>NO: sftp user@host
    >>>
    >>>
    >[root@igloo root]# sftp sshuser@localhost
    >Connecting to localhost...
    >sshuser@localhost's password:
    >Received message too long 796226418
    >[root@igloo root]#
    >
    >NOT WORK!
    >
    >This is all .... some suggest?
    >
    >Many thank for your attention.
    >
    >
    >

  • Next message: Chris Callahan: "PAM issues with 3.7p and 3.8p"

    Relevant Pages

    • Re: Recommended number of threads? (in CPython)
      ... I wrote run-of-the-mill program for concurrent execution of ssh command ... and if the thread is finished, it closes ssh connection and does .join ...
      (comp.lang.python)
    • Re: ksh silently ignores function if mistakenly not autoloaded
      ... Here's the order of execution. ... This really takes place prior to command ... Shell scripts, with all their power, have one major drawback - they ... In the Korn Shell, there are two separate syntaxes for defining ...
      (comp.unix.shell)
    • Re: SSL VPN
      ... I ssh from the server (which is ... behind a firewall) out to my home computer and leave this connection ... And why "localhost"? ... The "-N" says not to execute a command on the remote computer. ...
      (Fedora)
    • Re: SSH options re: NAT
      ... No, SSH is two-fold, a call to it on the client side results in a call ... port, meaning that any connections that come into that port are answered ... programming practice for daemons) Once the connection is established, ... don't want to execute a command on the remote side and you use -N. ...
      (comp.security.ssh)
    • Re: New to VB.NET...HELP REQUIRED IMMEDIATELY
      ... Scott - a DataReader requires an open and available connection and is only ... than one command over the same connection at one time - even if the command ... The execution of the first command ins't ...
      (microsoft.public.dotnet.languages.vb)