I would like to do the following :

If I login as user ABC via the login screen, do nothing. However if I ssh as ABC, then I want to run a root script, without being prompted for roots password, and without having to store roots password somewhere on the disk.

The motivation for this is outlined in the article in Linux : restricting outgoing on an application basis . Basically, inspired by the article https://unix.stackexchange.com/questions/21650/how-to-restrict-internet-access-for-a-particular-user-on-the-lan-using-iptables , what I want to do is the following :

1)Login as user EFG and use firefox to access the web.

2)ssh into ABC.

3)Upon ssh'ing into ABC, I want to run the a script which emulates "sudo iptables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP" where 1234 is the UID of user ABC

4)Then start using, under the ssh'ed terminal for ABC, all the applications which I do not want to have internet access, whilst still logged in as user EFG, hence allowing me to surf the internet as EFG.

Note I tried messing around the /etc/network/interfaces file, however I had some problems with the computer not being able to start properly if the computer was not connected to the network.



The easiest way is to use a forced command against an SSH key.

Create an SSH key for the user with ssh-keygen and add the public key to ~/.ssh/authorized_keys for user ABC, prefixing it with command="/some/script"

The script can contain the sudo commands you want to run and then exec a shell if needed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.