Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'd like to use a passwordless key to perform e.g. unison synchronization while being able to SSH into the server only with a password-protected key. The usual way of using scponly is changig the login-shell of my server account, but that is too global. Can an entry in authorized_keys achieve this instead?

share|improve this question
add comment

1 Answer 1

up vote 4 down vote accepted

You can use command keyword in authorized_keys to restrict execution to one single command for particular key, like this:

command="/usr/local/bin/mysync" ...sync public key... 

Update: If you specify a simple script as the command you may verify the command user originally supplied:

#!/bin/sh 

case "$SSH_ORIGINAL_COMMAND" in 
/path/to/unison *) 
$SSH_ORIGINAL_COMMAND 
;; 
*) 
echo "Rejected" 
;; 
esac 
share|improve this answer
    
Doesn't that simply execute that command? I'd like sshd to only allow a ssh server -c unison ... while any other attempt to connect with that key should not execute anything but simple refuse connecting –  Tobias Kienzler Nov 14 '12 at 8:32
    
It is possible, I updated the answer. But what the reason for such behavior? If you have the key you have permission to sync. So you rather connect and do the job or don't connect at all... –  Andrey Voitenkov Nov 14 '12 at 9:13
    
Perfect, I used case "$(basename $SSH_ORIGINAL_COMMAND)" in \n unison *) though. The reason is I want to have a private key that doesn't require a password so unison can run unattended (e.g. as a cronjob), while that key should not be capable of allowing a SSH access. Of course unison could be abused to replace authorized_keys... –  Tobias Kienzler Nov 14 '12 at 9:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.