commands in authorized_keys

Question

I've created an SSH non root/non super user with an authorized_key to remotely login to my server and shut it down however, i'm trying to do this from within the authorized_key file by using the command="" syntax

I have the following in the authorized_keys file

command="shutdown -p now",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa 

However when trying to execute the ssh login, while the user is able to login....the command doesn't seem to be executed.

What is the correct syntax for commands when being used in the authorized_keys?

how does no-port-forwarding,no-x11-forwarding,...etc affect the user's ability to login with the command remotely?

the command

/usr/bin/ssh -2 -i /path/to/.ssh/rsa -p 22 -vvv -l user xxx.xxx.0.25

debug information

debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp 
// REMOVED
debug3: sign_and_send_pubkey: RSA 
// REMOVED
debug1: key_parse_private_pem: PEM_read_PrivateKey failed
debug1: read PEM private key done: type <unknown>
Saving password to keychain failed
debug3: Incorrect RSA1 identifier
debug1: read PEM private key done: type RSA
Identity added: /.... //removed
(/.../.ssh/shutdown_rsa) // removed 
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to xxx.xxx.0.25 ([xxx.xxx.0.25]:22). //removed
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: client_input_global_request: rtype [email protected] want_reply 0
debug2: callback start
debug2: fd 3 setting TCP_NODELAY
debug3: packet_set_tos: set IP_TOS 0x10
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug1: Sending environment.
debug3: Ignored env TERM_PROGRAM
debug3: Ignored env SHELL
debug3: Ignored env TERM
debug3: Ignored env TMPDIR
debug3: Ignored env Apple_PubSub_Socket_Render
debug3: Ignored env TERM_PROGRAM_VERSION
debug3: Ignored env TERM_SESSION_ID
debug3: Ignored env USER
debug3: Ignored env SSH_AUTH_SOCK
debug3: Ignored env __CF_USER_TEXT_ENCODING
debug3: Ignored env PATH
debug3: Ignored env PWD
debug3: Ignored env XPC_FLAGS
debug3: Ignored env XPC_SERVICE_NAME
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env LOGNAME
debug1: Sending env LC_CTYPE = UTF-8
debug2: channel 0: request env confirm 0
debug3: Ignored env DISPLAY
debug3: Ignored env SECURITYSESSIONID
debug3: Ignored env _
debug2: channel 0: request shell confirm 1
debug2: callback done

Answer 1

Directive "command" in autorhized_keys DOES NOT executes specified command it only allows user to run this particular command remontly using this key.

Answer 2

Two guesses:

Protocol 2 public key consist of: options, key‐type, base64-encoded key, comment

I don't see the base-64 encoded key in the line in your authorized_keys file.

Identity added: /.... //removed
(/.../.ssh/shutdown_rsa) // removed 

Are you presenting more than one key? Your -vvv isn't complete You left out the important bit about which key was being offered. E.g.,

debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/Kendall/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 279

Answer 3

Same thing happened to me. Everything was in place but I was still logging-in normally without any specific command to be executed. It got solved until I double-checked which identity the ssh client was using, by adding -v for verbose mode. I realized it was using a cached key from ssh-agent, which I had to kill first. There is indeed not too much magic in that setup.

Answer 4

The provided command is always executed without arguments. The environement variable SSH2_ORIGINAL_COMMAND countains the command that was typed by the user.

You may consult the documentation here : https://support.ssh.com/manuals/server-admin/64/ssh-server-g3.html

command="command"

This is used to specify a "forced command" that will be executed on the server side instead of anything else when the user is authenticated. The command supplied by the user (if any) is put in the environment variable SSH2_ORIGINAL_COMMAND. The command is run on a pty if the connection requests a pty; otherwise it is run without a tty. Quotes may be used in the command if escaped with backslashes.

This option is useful for restricting certain public keys to perform just a specific operation. An example might be a key that permits remote backups but nothing else. Notice that the client may specify TCP/IP and/or X11 forwarding, unless they are explicitly denied (see no-port-forwarding and no-x11-forwarding below).

If terminal is explicitly allowed in the ssh-server-config.xml file, the forced command is run only when the user tries to run remote commands. If the user requests a shell, he can get it normally and the forced command is not run.

If a forced command is defined in the ssh-server-config.xml file, it overrides any commands in the authorization files. The configuration file might also allow only specific commands, or deny all remote commands. These restrictions apply also to commands in the authorization file.

For more information on command restrictions in the configuration file, see command.