0

I want to have a command line program that I made in Python automatically run when a certain user logs in on my server using SSH. But the user must not be able to escape the program or run any other commands.

The program allows the user to view certain server information and send messages to the admin. Can you think of anyway I can do this with the OpenSSH server in Ubuntu?

Thanks, Dave.

1 Answer 1

4

The safest approach is to define your command as the user's shell (instead of /bin/bash or similar). It will be difficult to circumvent unless there is a bug in your code.

The second safest approach is to use ForceCommand in your sshd configuration or command= in your authorized_keys.

Do not just put the command in .bash_profile or similar, it is a common mistake and very easy to circumvent.

Note that even when you restrict the user to this single command, they will still be able to open tunnels through the SSH session. You might want to prevent also that for untrusted users.

6
  • Thanks, I did not know you could replace the shell with a command. Thats what ill do. Aug 11, 2011 at 17:16
  • Keep in mind that you need to add the full path to your command in /etc/shells in order for it to be interpreted as a valid shell.
    – Alex
    Aug 11, 2011 at 17:30
  • @Alex, this is not true. By adding the untrusted custom shell in /etc/shells you are opening up additional holes.
    – snap
    Aug 11, 2011 at 17:37
  • I'm getting: /info.sh: Exec format error Connection to dxdservers.com closed. Aug 11, 2011 at 17:42
  • Set the command interpreter on the first line of your custom shell script, for python for example: "#!/usr/bin/python". Also give your custom shell execute permissions: "chmod 755 /your/script".
    – snap
    Aug 11, 2011 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .