How can I allow a linux subversion user to only execute svnserve?

Question

I've got a user that I'd like to only be able to use subversion. We like to use svn+ssh:// URLs sometimes (for public keys and whatnot), so I need them to be able to connect over ssh and run only the svnserve command.

When using a svn+ssh URL, svn ssh'es in and passes the arguments "-c svnserve -t". I wrote a custom shell as follows to filter the commands that can be run. This works, but it's not passing the input to svnserve, so when I try to "svn up" I get "svn: Connection closed unexpectedly".

#!/bin/bash
if [ "$1" == "-c" ] && [ "$2" == "svnserve" ] && [ "$3" == "-t" ] && [ "$4" == ""] ; then
        exec svnserve -t
else
        echo "Access denied. User may only run svnserve."
fi

Answer 1

I am pretty sure you could put something like this at the end of your sshd_config.

Match User svnuser
  ForceCommand svnserve -t

Answer 2

In the file authorized_keys add the line command="svnserve" and whatnot at the beginning of his key. In this way when he connect with ssh it will run that command then exit, e.g.

command="svnserve" ssh-rsa AAA...LONG AND TEDIOUS KEY...== user@localhost

check man sshd and the subversion documentation for details