Red Hat

I have a solution and would welcome opinions, especially those that can pick holes in it.
I now have my three groups of users.

Then in /etc/ssh/sshd_config, code this towards the end:-

Code:

Match Group sshrestr
     ForceCommand     /usr/local/bin/ssh_restricted

Then, in /usr/local/bin/ssh_restricted, pop in the following:-

Code:

#!/bin/ksh
if [ -z "$SSH_ORIGINAL_COMMAND" ]
then
   exec `grep "^\`id -un\`:" /etc/passwd|cut -f7 -d":"`
else
   logger "Access denied attempting \"$SSH_ORIGINAL_COMMAND\""
   if [ "$SSH_ORIGINAL_COMMAND" != \
        "/usr/sbin/sftp-server -m /etc/ssh/sshd_config" ]
   then
      print "Access denied"
   fi
   exit
fi

The bit in green may need to be adjusted depending what you see in the syslog. That part is only to prevent the SFTP client getting a horrible error. This seems to prevent scp and remote commands with ssh, although I'm sure it could easily be adjusted to cater for them if we were to need them. This only prevents remote commands for users with the sshrestr group, so things such as backups, application updates etc. over ssh would be unaffected if run by any other user.

Does anyone have anything glaringly obvious, or even something subtle that is missed by this?


Thanks, in advance,
Robin
Liverpool/Blackburn
UK

I forgot about 'service' accounts that should not be logged on to directly, even if the password is known, but I've hit upon another suggestion posted elsewhere that I should include.

If you have an account that should not login, but it runs services, you can just set the default shell to /dev/null, /bin/false etc. as you choose, however with use of su - userid -s /bin/ksh you can still switch user to it if you need to.

To start services (probably at boot or scripted) you would:-

Code:

su - userid -s /bin/ksh start_script

It stops login, but allows function. Of course, there are bound to be things that will fall foul of this arrangement, but I thought it would be honorable to include it for anyone finding this thread, to have it available to consider.



Robin