ssh question

[Michael Murphy_2]

I want to set up ssh to allow a user to remotely run a command but not to actually log on to a box - is there a way to do that?

Thanks

[Vipulinux]

Hi

You cab try using: rexec

http://linux.about.com/library/cmd/blcmdl1_rexec.htm

Cheers

[Sung Oh]

Hi Michael,

you can use remsh command to run a commend line based task remotely.
http://docs.hp.com/en/B2355-90690/remsh.1.html

here is an example of remote command via ssh.
http://www.itc.virginia.edu/desktop/security/ssh.html

Regards,
Sung

[Michael Murphy_2]

More info:

I want to be able to:
ssh "command"

but not

ssh

the latter being a login to the machine

[Darrel Louis]

Hi Michael,

I don't think it's possible, because ssh, scp and sftp all uses the same port(22).
I quess you don't want to use rcp/remsh because of the security risks.

Maybe you can check for a restricted shell, where you only allow scp, but don't know if it's possible.

Darrel

[Ken Grabowski]

Sorry to say, but no there isn't. How ever you can achieve the same results through other means.

To use ssh as an equivalent to rexec or remsh you have to assign a working shell program like /usr/bin/sh to the user account. But you can edit the .profile and add:
cleanupExit() # Declare an exit routine
{
print "Bye!"
sleep 1
exit 0
}
print "Sorry! You may not login directly into this system!"
print "Press Return to Continue"
read
cleanupExit

Put the cleanupExit at top of .profile and the rest at the bottom. ssh will still work just fine as a remote shell command, but the user can not successfully login to the system.

The only problem with this approach is if you have password aging enabled. At some point the user will have to approach you to reset their password, even if you use certificates.

[Darrel Louis]

Hi,

I've tested the following:

- Added the following to my .profile
echo " No shell Login allowed"
exit

I'm able to scp to the server and logged out when I try ssh .

You can also add "trap" codes to the .profile.

Darrel

[Ninad_1]

Yes you can do as have mentioned with ssh

ssh hostname "command"

Please refer
http://unixhelp.ed.ac.uk/CGI/man-cgi?ssh+1
for some help.

Regards,
ninad

[Josiah Henline]

Try setting the user's shell to "/usr/bin/false" in the /etc/passwd file.

[Ralph Grothe]

Certainly it is possible to distribute so called command rsa key files which allow only the commands the distributor placed in them.

Create a new rsa (or dsa) key pair

$ ssh-keygen -t rsa -b 1024 -N "" -f ~/.ssh/id_rsa_cmd

Edit the public key of the pair and place the commands you wish to be executed in the header.

$ vi ~/.ssh/id_rsa_cmd.pub

$ dd if=~/.ssh/id_rsa_cmd.pub bs=25 count=1 2>/dev/null;echo
command="hostname;uptime"

Distribute the public key to a remote ssh host where you want this command to be run on connect.

$ ssh saz@gouda 'cat >>.ssh/authorized_keys' < ~/.ssh/id_rsa_cmd.pub

Run a login with this key

$ ssh -i ~/.ssh/id_rsa_cmd saz@gouda
gouda
11:13am up 104 days, 23:35, 1 user, load average: 1.31, 1.47, 1.53
Connection to gouda closed.


To abbreviate the invocation you could edit
~/.ssh/config
on the SSH client and add a
Host entry
with
IdentityFile ~/.ssh/id_rsa_cmd

Then you can omit the -i switch.
See "man ssh_config" for details.

[Michael Kalisz]

Check the ssh forced commands feature:

http://www.oreilly.com/catalog/sshtdg/chapter/ch08.html

//Michael