Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently setting up a linux box that is tied into Active Directory. This box will allow users to SSH into it with their AD username and password to gather information (Box A). The issue is I am trying to create a function in /etc/bash.bashrc so the users has to do is type "get_info" for example, the function will SSH into a remote machine (Box B) run a command and output the information back to the user.

The issue with this is, I have generated a rsa key on Box A, added it to the Box B authorized_keys and it works fine. The issue I am running into is, how do I set this up one time for the current users and any new user who logs into Box A.

Is there a better approach than what I am currently doing. Essentially I just need to connect to the remote box, run a command, output the information back to the user and that is it. How can I allow new users to connect via a script to the remote box without having to generate RSA keys for them.

The get_info fuction will be supplied a value 'get_info 012345' and returns the results.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

What is needed:

  • Shared keys by users
  • Create common script on server
  • In your ssh config limit user to particular commands:

    command="/bin/myscript.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dss AAAAB3....o9M9qz4xqGCqGXoJw= user

  • Create script on local box or in their home folders that executes an ssh command to the remote server, executes the script on server and then outputs

  • If you need input into the remote session, you could run your local script

    ./local.sh 01234

Which executes:

ssh user@remote '/bin/myscript.sh $1'

It is interpreted as

ssh user@remote '/bin/myscript.sh 01234
share|improve this answer
    
Do you have any references on how to do the following. I have a key already made that allows a passwordless connection via SSH, the issue is when I log in as a different user, using the same key, it will prompt for the password to use with the key. Is there a way that I can prevent this so new users will not have to type in the password? –  jinanwow Jun 21 '10 at 14:29
    
If you are using multiple different usernames, then a authorized_keys file will need to he added to all of the /home/$USER/.ssh folder. Remember to chmod 400 the authorized_keys file as well. –  David Rickman Jun 21 '10 at 15:10
    
I may have done the steps backwards. On Box A (which is everyone is logging into) I ran the ssh-keygen command then put the authorized_keys on Box B (script will connect to this box). Should I generate the key on Box B then put authorized_keys on box A for each user? –  jinanwow Jun 21 '10 at 18:18
    
Thanks for pointing me in the right direction. I used the following information here: debianclusters.org/index.php/Password-less_SSH_for_Users I modified that script (just a tad bit), ran it, echoing all of the users public keys into a master file, then copied the master file from Box A to Box B and cat that file into the authorized_keys on the remote box. –  jinanwow Jun 21 '10 at 20:29
    
Sweet, sounds good. Sorry that I didn't get back to you in time. I would have probably explained it closely following the tutorial. –  David Rickman Jun 25 '10 at 11:19
add comment

Rather than changing /etc/bash.bashrc, why not create a program (maybe written in bash) that sits in the standard PATH for all users on the localhost. This program can call ssh with a flag to point to a common private key on the local system (e.g. you could put it in /etc or /etc/opt/ somewhere). The remote system would have a single account that contained the public key file, modified (see the ssh man pages) so that anyone using the public key can only execute one command (i.e. your informational command).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.