Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to do the following :

If I login as user ABC via the login screen, do nothing. However if I ssh as ABC, then I want to run a root script, without being prompted for roots password, and without having to store roots password somewhere on the disk.

The motivation for this is outlined in the article in Linux : restricting outgoing on an application basis . Basically, inspired by the article http://unix.stackexchange.com/questions/21650/how-to-restrict-internet-access-for-a-particular-user-on-the-lan-using-iptables , what I want to do is the following :

1)Login as user EFG and use firefox to access the web.

2)ssh into ABC.

3)Upon ssh'ing into ABC, I want to run the a script which emulates "sudo iptables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP" where 1234 is the UID of user ABC

4)Then start using, under the ssh'ed terminal for ABC, all the applications which I do not want to have internet access, whilst still logged in as user EFG, hence allowing me to surf the internet as EFG.

Note I tried messing around the /etc/network/interfaces file, however I had some problems with the computer not being able to start properly if the computer was not connected to the network.

Thanks

share|improve this question
add comment

1 Answer

The easiest way is to use a forced command against an SSH key.

Create an SSH key for the user with ssh-keygen and add the public key to ~/.ssh/authorized_keys for user ABC, prefixing it with command="/some/script"

The script can contain the sudo commands you want to run and then exec a shell if needed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.