0

I want to have a command line program that I made in Python automatically run when a certain user logs in on my server using SSH. But the user must not be able to escape the program or run any other commands.

The program allows the user to view certain server information and send messages to the admin. Can you think of anyway I can do this with the OpenSSH server in Ubuntu?

Thanks, Dave.

4

The safest approach is to define your command as the user's shell (instead of /bin/bash or similar). It will be difficult to circumvent unless there is a bug in your code.

The second safest approach is to use ForceCommand in your sshd configuration or command= in your authorized_keys.

Do not just put the command in .bash_profile or similar, it is a common mistake and very easy to circumvent.

Note that even when you restrict the user to this single command, they will still be able to open tunnels through the SSH session. You might want to prevent also that for untrusted users.

  • Thanks, I did not know you could replace the shell with a command. Thats what ill do. – David Maitland Aug 11 '11 at 17:16
  • Keep in mind that you need to add the full path to your command in /etc/shells in order for it to be interpreted as a valid shell. – Alex Aug 11 '11 at 17:30
  • @Alex, this is not true. By adding the untrusted custom shell in /etc/shells you are opening up additional holes. – snap Aug 11 '11 at 17:37
  • I'm getting: /info.sh: Exec format error Connection to dxdservers.com closed. – David Maitland Aug 11 '11 at 17:42
  • Set the command interpreter on the first line of your custom shell script, for python for example: "#!/usr/bin/python". Also give your custom shell execute permissions: "chmod 755 /your/script". – snap Aug 11 '11 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.