Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to allow users to run a limited set of commands.

But not to allow them to create interactive sessions.

Just like GitHub does.

If you try to ssh without a command it greetings you and close the session.

I can acquire this by using ForceCommand some-script

But getting in some-script i then need to eval user's input.

Perhaps any other NoTTY-like option in sshd_config?

--- UPDATE ---

i'm looking for a pure SSH / Bash solution, not Perl/Python/etc. hacks.

share|improve this question
1  
Not allocating a terminal is not the same as restricting what can be done. If you want to read interactive input you need a terminal. –  mgorven Oct 22 '12 at 20:50
    
ok, how do i close the connection if user did not provide any command? like: ssh user@host ls will execute ls on remote host, but ssh user@host will close the connection without execute anything? –  Dani El Oct 22 '12 at 20:57
add comment

4 Answers

up vote 4 down vote accepted

You're on the right track with setting ForceCommand to a script. You need to then inspect the SSH_ORIGINAL_COMMAND environment variable, which contains the actual command which the user provided to the SSH client. For example:

#!/bin/sh

case "$SSH_ORIGINAL_COMMAND" in
    date)
        date
        ;;
    fortune)
        fortune
        ;;
    *)
        echo "Valid commands are: date, fortune"
        exit 1
        ;;
esac

The user can then execute commands like this:

% ssh localhost fortune 
Q:   How much does it cost to ride the Unibus?
A:      2 bits.

If the user doesn't provide a command they should get an error message from the script (and the connection terminated):

% ssh localhost
Valid commands are: date, fortune, rev
Connection to localhost closed.

Edit: It is possible to disable a terminal in authorized_keys when using key authentication:

command="/usr/local/bin/restricted.sh",no-pty ssh-rsa AAA...
share|improve this answer
    
yep, i already have this working. i just wonder if i can do the same without ForceCommand. I were sure there are an option in sshd like DisableTTY or something. Just can not recall its name and can not find in man pages, grrr.... –  Dani El Oct 22 '12 at 21:02
    
yea, no-pty is the option i were looking for. but i want to set it in sshd_config, not in authorized_keys, before each key. this becomes hairy :) –  Dani El Oct 22 '12 at 21:33
    
@DaniEl It doesn't look like it. –  mgorven Oct 22 '12 at 21:41
    
ok, it does not, but i yet want to set this option in sshd_config. Is this doable? NoPTY does not seem to work –  Dani El Oct 22 '12 at 22:36
    
@DaniEl I don't think it's possible. There's no real problem with allocating PTYs however. –  mgorven Oct 22 '12 at 22:37
show 2 more comments

If you only want to allow git commands, set the user's shell to git-shell with the following command:

usermod -s /usr/bin/git-shell <USERNAME>

git-shell is part of the git package.

If you want to allow arbitrary commands, mgorven's answer is the way to go.

share|improve this answer
add comment

Take a look on the sshd man page in the AUTHORIZED_KEYS FILE FORMAT section. I think you are looking for no-pty option.

share|improve this answer
    
oh yes, that's it, no-pty, i confused it with no-tty :) ok, any way to set it in sshd_config rather than per key? –  Dani El Oct 22 '12 at 21:31
add comment

Take a look on this script:

http://lists.fusionforge.org/pipermail/fusionforge-general/2012-May/001795.html

It's a perl script restricting the commands...

share|improve this answer
1  
Link-only answers are highly discouraged. Please provide content here and link elsewhere for more detail. –  EEAA Oct 22 '12 at 20:34
    
Well.. it's just a simple script that can be use to restrict shell commands. To use, you just have to put this script as the shell script in /etc/password –  KikoV Oct 22 '12 at 20:42
2  
Right. Your answer still has zero content. What happens when that link goes dead? Your answer is worthless. Again, provide some content here, making sure to link to the original source for attribution and more detail. –  EEAA Oct 22 '12 at 20:43
    
Ok, some contents from Roland Mas –  KikoV Mar 1 '13 at 17:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.