Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to have a command line program that I made in Python automatically run when a certain user logs in on my server using SSH. But the user must not be able to escape the program or run any other commands.

The program allows the user to view certain server information and send messages to the admin. Can you think of anyway I can do this with the OpenSSH server in Ubuntu?

Thanks, Dave.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

The safest approach is to define your command as the user's shell (instead of /bin/bash or similar). It will be difficult to circumvent unless there is a bug in your code.

The second safest approach is to use ForceCommand in your sshd configuration or command= in your authorized_keys.

Do not just put the command in .bash_profile or similar, it is a common mistake and very easy to circumvent.

Note that even when you restrict the user to this single command, they will still be able to open tunnels through the SSH session. You might want to prevent also that for untrusted users.

share|improve this answer
    
Thanks, I did not know you could replace the shell with a command. Thats what ill do. –  dx282 Aug 11 '11 at 17:16
    
Keep in mind that you need to add the full path to your command in /etc/shells in order for it to be interpreted as a valid shell. –  Alex Aug 11 '11 at 17:30
    
@Alex, this is not true. By adding the untrusted custom shell in /etc/shells you are opening up additional holes. –  snap Aug 11 '11 at 17:37
    
I'm getting: /info.sh: Exec format error Connection to dxdservers.com closed. –  dx282 Aug 11 '11 at 17:42
    
Set the command interpreter on the first line of your custom shell script, for python for example: "#!/usr/bin/python". Also give your custom shell execute permissions: "chmod 755 /your/script". –  snap Aug 11 '11 at 17:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.