Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Creating a UNIX account which only executes one command

There is a shell script which has to be executed through an existing user account XXX. Now I have various other users which shall be able to execute only this script as well without getting access to the user account XXX. Is there a way to create a ssh command (maybe through a key or anything else), which only allows to execute this specific shell script of the user XXX without knowing the password of XXX?

share|improve this question

marked as duplicate by Gilles, Renan, jasonwryan, manatwork, Nils Jan 8 '13 at 12:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 4 down vote accepted

If running the script is the only thing you want those other users to be able to do, then I'd go with using ssh keys.

Each user should have their own ssh key, so you won't get into a hassle when somebody no longer needs access. The public part of the key should be put into


and in front of the actual key, you should add the text command="/path/to/script"

Here's an example:

from="",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/path/to/script"  ssh-dss A........

This limits the ip-address that this key can be used from, and it limits what kind of forwarding can be done, and makes sure that no pty can ever be granted when using this key, and whenever the user connects with this key then the script will be run and nothing else can happen.

To add an environment variable, you just add it too to the key:

from="",environment="MYVARIABLE=whatever",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/path/to/script"  ssh-dss A........

However, in order for that to work, you have to have the PermitUserEnvironment directive set to "yes" in the sshd config file. If you can't make that happen, you can instead change the line to this:

from="",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="export MYVARIABLE=whatever; /path/to/script"  ssh-dss A........
share|improve this answer
I guess that's what I need. I will give it a try. Thanks! – user29866 Jan 7 '13 at 16:05
Just one more question, when a need a variable for the shell script, how do I forward it with ssh and how will look the example command part in the file authorized_keys? – user29866 Jan 7 '13 at 16:37
I'm adding that info to the answer. – Jenny D Jan 8 '13 at 8:06
I referred to the command. Here my shell script needs variables. So I can't specify them already in authorized_keys. Now I changed my script and read them with $SSH_ORIGINAL_COMMAND. – user29866 Jan 8 '13 at 16:25

In short, no. simply because ssh will require a password every time unless you have keys set up.


you could ssh into the machine as your user and execute the script as long as the owner of the shell script has done the following:

chmod o+s <file>

that will set the "effective UID" that the script will run with every time (also referred to as setuid).

share|improve this answer
but the script has to be executed by the user XXX.might be there an other way to give a key and a new password just being able to execute this script? – user29866 Jan 7 '13 at 16:04
with setuid, the script will run with the owners permissions. if i had a script in my home directory with setuid any user can login to the machine and execute the script. while that script is running it is acting as if the owner executed it. – h3rrmiller Jan 7 '13 at 16:06
Setuid scripts don't execute as the owner because it's a security vulnerability. See here for details. (note that this is not quite true on all systems, but it is true at least on Linux) – joshlf Mar 11 '15 at 0:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.