Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to restrict an ssh-user from executing unwanted commands through ssh from a remote host. For that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command.

If I did not set this, I am able to login via ssh and sftp.

How can I differentiate whether the remote connection is issued via ssh or sftp in a shell script?

The command that I am expecting is as follows and these both should work:-

ssh ssh-user@hostname test_scripts.sh

sftp ssh-user@hostname

I used the variable $TERM to differentiate between ssh and sftp. If it is sftp then the $TERM will return 'dumb'. But when we are passing a command through ssh then also the $TERM is returning dumb. Any idea how to differentiate?

Adding More details to the question :-

if [ $TERM = 'dumb' ]; then

$SSH_ORIGINAL_COMMAND #If sftp, execute this

else

echo "This is ssh" #If ssh, execute this

fi

The above script is the invoked via forced command. When I am connecting remotely through ssh then I am getting the message as expected as "This is ssh"

ssh ssh-user@hostname This is ssh

And when I am trying to connect through sftp then as expected the if condition got true and I am getting the sftp prompt.

sftp ssh-user@hostname sftp>

But when I am passing a command along with the ssh command then the $TERM is set to dumb. So the if condition got true.

ssh ssh-user@hostname ls

I need to distinguish between the latter two methods in the above script. Could anyone help me on this?

share|improve this question
add comment

1 Answer 1

Have a look at Restricted Bash - usually at /bin/rbash. I used this recently to achieve something similar to what you're trying to do (after farting about with chroot jails and not really getting anywhere).

For the users that I wanted to restrict, I set their terminal to /bin/rbash and their PATH to ${HOME}/bin. I then created a symlink to whatever commands I wanted them to be allowed to run in their ${HOME}/bin directory. I don't think it's 100% foolproof but it did the job with my users.

I haven't tested it for commands that are sent as part of the SSH command-line but I don't see why it wouldn't work so long as the user's shell is set to rbash.

share|improve this answer
    
This is a normal user in the server. He should be allowed the sftp prompt. But the user should not be allowed a prompt while connected via ssh. The user should be allowed to execute commands passed along with ssh as follows e.g :- ssh user@hostname <cmd> –  user156372 Jan 28 '13 at 12:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.