Bumped by Community user
    Bumped by Community user
6 edited body
source | link

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so I can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So I couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can iI enable behavior which iI need, iI only check rrsync script from rsync's docs. This method has no chroot feature I need.

Can I have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so I can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So I couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can i enable behavior which i need, i only check rrsync script from rsync's docs. This method has no chroot feature I need.

Can I have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so I can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So I couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can I enable behavior which I need, I only check rrsync script from rsync's docs. This method has no chroot feature I need.

Can I have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)
    Tweeted twitter.com/StackUnix/status/745650489996484608
5 In English, the pronoun 'I' is capitalized. removed bash tag as it's not core to the question
source | link

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why iI need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so iI can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So iI couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can i enable behavior which i need, i only check rrsync script from rsync's docs. This method has no chroot feature iI need.

Can iI have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why i need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so i can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So i couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can i enable behavior which i need, i only check rrsync script from rsync's docs. This method has no chroot feature i need.

Can i have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)

I have two users and one shared folder in my Ubuntu server:

  1. User writer, which has write access to /var/shared. It's an application regularly making file changes in this folder from remote, with SSH key.

  2. User reader is used by multiple clients with SSH key, a key they can get without my permission, that's why I need to restrict commands available in this shell.

Question:

I need to restrict commands accessible for reader user, so it can use only sftp and rsync protocols (no standard commands like mkdir, ls, top, ..); Only directory /var/shared must be readable, and must be a root path, e.g. no need to cd into it, it's already / in sftp or rsync.

How to write a shell script so I can apply it with usermod -s for user reader that will give such behavior? I cannot find any samples. How to make writer also remain "jailed" to /var/share, so paths are same?

Notes

  1. I have tried sshd_config's Match, ForceCommand internal-sftp and ChrootDirectory directives already. This requires ChrootDirectory to be owned by root and non-writable (755 or less), also does not support rsync

  2. I have tried rssh, but it simply don't work for directories outside home directory for logged in user. So I couldn't chroot users to same directory with different permissions...

  3. I tried to use command=".." ssh-rsa.... in authorized_keys file, but didn't get how can i enable behavior which i need, i only check rrsync script from rsync's docs. This method has no chroot feature I need.

Can I have a sample at least for such shells? Is this achievable with scripts?

Bash and C++(if needed) are welcome. Output of ldd /bin/bash:

    linux-vdso.so.1 =>  (0x00007fff7e9d1000)
    libtinfo.so.5 => /lib/x86_64-linux-gnu/libtinfo.so.5 (0x00007f79dfd8b000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f79dfb87000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f79df7bd000)
    /lib64/ld-linux-x86-64.so.2 (0x000055bd0767c000)
4 edited title
| link

Create SSH shell with chroot and only working "sftp", "rsync" and chroot(both)?

3 added 110 characters in body
source | link
2 added 110 characters in body
source | link
1
source | link