How to restrict ssh by forced commands but sftp login should be enabled? Post: 302762653

Sponsored Content

Top Forums Shell Programming and Scripting How to restrict ssh by forced commands but sftp login should be enabled? Post 302762653 by Anil George on Tuesday 29th of January 2013 12:23:13 AM

01-29-2013

Registered User

My requirement is similar to the 'chroot jail', but not exactly the same.
I have to restrict the ssh-user to execute only one script(wrap_script.sh) and he should not be allowed to login via ssh to a remote server.

eg:-

Code:

ssh ssh-user@hostname wrap_scripts.sh

Once this script is executed, the control has to come back to the client system. The client system should be allowed to connect to the remote server using sftp and he should get the sftp prompt.

eg:-

Code:

sftp ssh-user@hostname
sftp>

The ssh-user should be only restricted if the connection has come through ssh from a particular client system. Else it should be a normal user.

That is the reason I thought of going for the forced commands in the authorization_keys file in the remote system. So when the connection is coming from that particular client, I should be able to restrict access to that. The ssh-user is a generic user that will be used by other client systems to connect to the remote server. But I need to restrict a particular host as mentioned above.
Thanks in advance. Could anyone please advice?

Last edited by Scrutinizer; 01-29-2013 at 02:27 AM.. Reason: code tags

Anil George

View Public Profile for Anil George

Find all posts by Anil George

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

How to restrict user to sftp usage?

Hi everyone! I have a problem... I need to restrict user to sftp usage only from one computer to another... I mean that the user cannot login to the computer or even use sftp from other computer only from the one i allow. thanx for the help!

2. Solaris

restrict commands

Dears, how to determine the commands that could be used by certain user..like I want to prevent some users from running pwd command???? Thanx

3. Shell Programming and Scripting

Generate Public Key when the server is not ssh enabled

I am writing a script that needs to access various servers some of which are not ssh enabled. In order to access the ssh enabled servers I am using the following command to generate the public key : ssh-keygen -t rsa Is there a similar command for the other servers as well. If I try to use...

4. UNIX for Advanced & Expert Users

Generate Public key for non ssh enabled servers

5. Shell Programming and Scripting

how can i restrict commands

hi all, i want to restrict commands to run from a specifc directory..and to make that only some specific commands to run ,,not all. please help me ...how can i make this happen.

6. Shell Programming and Scripting

How ti check if passwordless ssh is enabled between two systems

I am writing a script which will execute commands on remote host only if they have a passwordless ssh setup. How do i check for that in my script

7. Shell Programming and Scripting

Automating file transfer between two SSH enabled server.

Hi Experts, Few more words to the title, both the servers are ssh enabled but I have read only access to the second server, so I cannot automate SFTP process using RSA/DSA keys. I am using Control M to trigger the script and do not want any manual intervention to enter the password to complete...

8. Red Hat

Chroot sftp users, remote sftp login shows wrong timestamp on files

Hello, I have a weird issue, I have RHEL 5.7 running with openssh5.2 where sftpgroup OS group is chroot. I see the difference difference in timestamp on files, when I login via ssh and SFTP, I see four hour difference, is something missing in my configuration. #pwd...

9. Red Hat

SFTP user include/exclude without preventing SSH login

I have been asked to see if we can restrict SFTP access to authorised users only. There will be business users who will log on with SSH, but they are locked into a menu. They will have write access to the production data to do their job, but we don't want them to have access to read/write the...

10. Shell Programming and Scripting

Commands not working with ssh remote login

Hi Friends, I am unable to run our application commands on remote server using ssh (passwordless login enabled). But the same command running with telent perl script. please suggest. SSH: C:/bin>ssh -l monitor tl04cp01 exec "/home/monitor/123" /home/monitor/123: viewlog: not found. ...

LEARN ABOUT X11R4

sftp-server

sftp-server(1M)                                           System Administration Commands                                           sftp-server(1M)

NAME

       sftp-server - SFTP server subsystem

SYNOPSIS

       /usr/lib/ssh/sftp-server

DESCRIPTION

       sftp-server implements the server side of the SSH File Transfer Protocol as defined in the IETF draft-ietf-secsh-filexfer.

       sftp-server is a subsystem for sshd(1M) and must not be run directly. There are no options or config settings.

       To enable the sftp-server subsystem for sshd add the following to /etc/ssh/sshd_config:

       Subsystem   sftp     /usr/lib/ssh/sftp-server

       See sshd_config(4) for a description of the format and contents of that file.

       There is no relationship between the protocol used by sftp-server and the FTP protocol (RFC 959) provided by in.ftpd.

EXIT STATUS

       The following exit values are returned:

       0        Successful completion.

       >0       An error occurred.

FILES

       /usr/lib/sftp-server

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE         |      ATTRIBUTE VALUE        |
       +-----------------------------+-----------------------------+
       |Availability                 |SUNWsshdu                    |
       +-----------------------------+-----------------------------+
       |Interface Stability          |Evolving                     |
       +-----------------------------+-----------------------------+

SEE ALSO

       sftp(1), ssh(1), ssh-add(1), ssh-keygen(1), sshd(1M), sshd_config(4), attributes(5)

       To  view  license  terms,  attribution,  and  copyright  for OpenSSH, the default path is /var/sadm/pkg/SUNWsshdr/install/copyright. If the
       Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
       location.

AUTHOR

       Markus Friedl

SunOS 5.10                                                          30 Jul 2003                                                    sftp-server(1M)