UNIX for Dummies Questions & Answers

Hi, I've just been trying to setup so that server1 can ssh into server2 and execute a limited set of commands only without password login. I want it also to be able to login with a password if no command given at all though (bit I'm stuck on).

I have got this almost working with authorized_keys and

from="hostofserver1",command="/pathtocomandstocheck.sh" rest of key> in authorized_keys file.

This all works fine, so I can "ssh server2 ls" and all works fine (as I have allowed ls in the script). If I enter a wrong command it doesn't do anything and kicks me out. So far so good.

Only problem is that with that key/entry in place, I can no longer login to the box normally if wanted with a normal password.

So I want to be able to "ssh server1 ls" checks keys and it works, no password needed. Or just "ssh server1" and it asks for a password, and assuming correct gives me a shell.

Any ideas, just the last bit I'm stuck on.

Thanks in advance.

I don't believe this will work quite how you want it too.

By using the command option, you are limiting that key to the specified commands, including the shell. To allow it you would need to add the shell to the command but that makes what you are trying to achieve pointless.

Here is what I would do:

Keep the key you have now, and use that like you have been. Create a second identity file with a second key.

Code:

ssh-keygen -f /path/new_id_rsa

Do not allow add it authorized_keys on the remote host and launch it like this:

Code:

ssh -i /path/new_id_rsa hostname

It should prompt for a password as normal. You could create a wrapper alias to save having to type the path to the identity file.

Please note this is untested, and there are probably better ways to do it. I have made a few assumptions (like it seems everyone connects to this system with the same account?).