5

I have several servers running Debian Lenny.

Just recently I discovered the PermitRootLogin=forced-commands-only directive for ssh, which allows me to run a scripted rsync as root with an ssl key, without enabling more generalized root ssh access.

However, last week this stopped working - it appears on all of my servers - and I can't figure out why.

Everything continues to work fine with PermitRootLogin=yes, but I would prefer to block root logins - especially via passwords.

The day it stopped working, we reconfigured some of the ports on one of our switches (which we later reverted), but I can't see that affecting this, since it still works with PermitRootLogin set to yes.

How can I diagnose why the forced-commands-only directive has apparently stopped working?

  • 1
    How about looking in the logs on the server to see what it says when you try? Up the logging in sshd? – Bill Weiss Feb 9 '10 at 21:52
  • I tried running sshd with the -d (debug) switch, which gave alot of output, but was very cryptic to me. It appeared that it was accepting the certificate, and then dropping the connection immediately afterward with no further explanation. – Brent Feb 10 '10 at 17:27
9

"PermitRootLogin forced-commands-only" requires that all connections, via SSH as root, need to use public key authentication and that a command be associated with that key (like 'validate-rsync').

If you want to login as root but only with keys use:

PermitRootLogin = without-password

To restrict rsync to a defined ssh-key you can specify in your authorized_keys:

from="<ip>",command="/usr/local/sbin/validate-rsync" ssh-dss AAAAZ5Hbl......

And save this wrapper to: /usr/local/sbin/validate-rsync

#!/bin/sh 

case "$SSH_ORIGINAL_COMMAND" in 
*\&*) 
echo "Rejected" 
;; 
*\(*) 
echo "Rejected" 
;; 
*\{*) 
echo "Rejected" 
;; 
*\;*) 
echo "Rejected" 
;; 
*\<*) 
echo "Rejected" 
;; 
*\`*) 
echo "Rejected" 
;; 
*\|*) 
echo "Rejected" 
;; 
rsync\ --server*) 
$SSH_ORIGINAL_COMMAND 
;; 
*) 
echo "Rejected" 
;; 
esac 

There is a slightly more complicated script shipped with rsync to do the same, http://www.samba.org/ftp/unpacked/rsync/support/rrsync

0

If rsync can login as root, then anybody can: there's no difference for the server what's knocking at. I believe it was either experimental/hacky, or they just realized it's not more secure than 'yes'.

I'd suggest you disabling password auth for root (e.g. remove the password at all and use sudo when needed) and rely on key auth method.

  • Are you saying that openssh has disabled this option recently? If so, how can I confirm that? – Brent Feb 10 '10 at 17:25
  • I'm not sure, just guessing :) anyway, it's not more secure than just yes! – kolypto Feb 11 '10 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.