Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm writing a simple program to back-up some files to a Linux box. The transaction will take place over SSH and each copy of the program will have its own account on the Linux box that it will connect to.

My concern is that it's likely a user of the software will figure out their account name and password (which will be randomly generated beforehand) and want to connect to the box and play around.

I would like to disable their ability to do anything on that box besides what I would authorize the back-up software to do. That is, they only need to create new files and read old ones (no updates or deletes). They shouldn't need the ability to execute bc or a who or anything of the sort.

I've thought about trying to chroot each user into their home directory, but I'm kinda fuzzy on how to do all that.

Any suggestions on how to achieve this desired functionality?

Thanks!

share|improve this question
add comment

3 Answers

up vote 10 down vote accepted

The authorized_keys file for an account can specify a command to be used whenever a specific key is used for authentication. This will require you to set up authentication using keys instead of user/password- although imho that's a good thing to do anyway.

For example, gitosis uses this method to allow people to connect to a server using ssh to tunnel the git protocol, but not allow them to login. The authorized_keys manpage gives examples, e.g.:

    command="dump /home",no-pty,no-port-forwarding ssh-dss AAAAC3...51R== example.net
share|improve this answer
    
Thanks this looks like the most elegant solution to implement! –  mrduclaw Dec 16 '09 at 14:50
add comment

Use scponly with the chroot option. This will give the users a special chrooted login, with only the binaries you want them to use.

See http://www.sublimation.org/scponly/wiki/index.php/Install

share|improve this answer
add comment

You can use rssh (http://www.pizzashack.org/rssh/), it's like scponly but supports scp, sftp , rsync & cvs

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.