Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to lock down a system so that a group of individuals can log into the server via ssh.

When they log into ssh I would like them to be presented with a screen session and locked down to that single application. This is so the application can continue to run in the background, while nothing else from the command line can be run.

Any ideas? Maybe there is a better solution than screen?

share|improve this question
add comment

3 Answers

consider dtach if all you want is the ability to have processes persist over user sessions. dtach is simply the "detaching" part of tools like screen and tmux boiled down to one small utility.

share|improve this answer
    
Yeah, dtach is the program I was thinking of when I mentioned tmux (which doesn't support detaching on its own). Whoops, this screen user has faulty knowledge of rest of the world… +1 for you. –  ephemient Oct 30 '10 at 4:50
    
Nice, I actually found dtach right after I posted this. I'm going to try it out with a chrooted/forcecommand ssh session. –  Spectre Oct 30 '10 at 4:52
add comment

Take a look at setting the command option to authorized keys (look in the sshd man page under AUTHORIZED_KEYS). If the users log in with a key configured this way, the command specified will be run instead of the user's shell or anything they may have entered on his or her ssh command line. You can either set it to run screen as you wanted, or merely the application in question.

share|improve this answer
add comment

Users can do pretty much anything once they enter screen. Ctrl-A :screen /bin/sh Enter and they have a shell; you can run screen as a different user and use :umask to prevent that, but users will still be able to read and write files (:readbuf, :writebuf), run commands (:exec), and so on.

tmux dtach is quite a lot simpler than screen.

share|improve this answer
    
Yeah I don't really need a multi-screen session... just a session so it can stay in the background and easily be accessed by users. –  Spectre Oct 30 '10 at 3:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.