ssh dissable login, but allow copy-id

Question

I have a user that's only used for a proxy, so no one can login.

#passwd file entry
proxyuser:x:996:99::/home/proxyuser:/bin/false

but, I'd like to enable ssh-copy-id to that user

How do I do that? Do I need a custom shell or what?

Answer 1

On most systems ssh-copy-id is a simple shell script which creates a list of local ids on the system running the ssh client software, connects to the remote system using ssh, asks the user to authenticate and copies the ids to the authorized_keys files on the remote system.

The last part of the script looks like this at least in openssh-6.4p1 on my Fedora 20 system:

printf '%s\n' "$NEW_IDS" | ssh "$@" "
            umask 077 ;
            mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ;
            if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh .ssh/authorized_keys ; fi" \
  || exit 1

So for ssh-copy-id to work you'll need a restricted remote shell which allows you to specify not only the commands the user can run but also the files he/she can access (using output redirection). I don't know any restricted shell that allows such customizations.

Answer 2

Usually I'd recommend using specifying a command in ~/.ssh/authorized_keys, but that does not make a lot of sense when the intention is to support ssh-copy-id.

A custom shell might work, but might be overkill. Another alternative to look into is the use of a ~/.ssh/rc file, which will run before the users shell.

For either approach you need to ensure you don't open any unwanted access. Three cases you need to verify are

• Normal ssh login which starts a login shell.
• Login with a single command to be executed.
• Login with -N that does not run any command at all, but permits port forwarding.

If there are any of those three, you do not want to permit, you should verify that your intended solution does not permit it through the use of the password or later by using the key installed by ssh-copy-id.