Passwordless SSH for "System User" with NO Login Shell

Question

I have learned a lot today messing around with ssh with RSA and creating system user accounts with no password, no login etc etc. What I was trying to do was create a user with a home directory needed for ~/.ssh/ and a password (needed for initial ssh setup)

But I can't seem to get it set-up correctly.

I know about using

ssh-keygen
ssh-copy-id user@remotehost

This is simple for RSA

and I know how to create a user with say

useradd -r newuser

OR

adduser newuser --system --shell=/bin/false
passwd newuser
passwd -d newuser

• The End Goal

  is a user who doesn't have a shell, or atleast can't be logged into from a remote computer, but can still be used to ssh over to another computer and run a command. Is this even possible?

• The REASON/GOAL

  is to have a user whom when the ups runs low on power, shuts down the other connected computers via ssh before shutting down the main computer. (Only one computer can connect to the UPS via USB at a time to monitor the stats).

I don't want people to be able to log in via SSH with the username UPS, but I need ups to be able to ssh into remotehost without password.

Answer 1

Set the crypt field to * or to !! in /etc/shadow

eg

# adduser tst  
# passwd -l tst
Locking password for user tst.
passwd: Success
# grep tst /etc/passwd
tst:x:1000:1000::/home/tst:/bin/bash
# grep tst /etc/shadow
tst:!!:17030:0:99999:7:::

At this point the user can not login because there's no valid password.

Now add a command="/thing/to/do" to the beginning of the public key in the authorized_keys file

eg

# ls -l $PWD/authorized_keys 
-rw-r--r-- 1 tst tst 431 Aug 17 17:54 /home/tst/.ssh/authorized_keys

# cat $PWD/authorized_keys
command="/bin/echo hello" ssh-rsa AAAAB3NzaC1yc2E....etcetc

Now this key can be used, but the only thing it can be used for is that forced command:

$ ssh -i ~/.ssh/id_rsa tst@test1
hello
Connection to test1 closed.

If you try to do anything else it'll fail, and still force the same command

$ ssh -i ~/.ssh/id_rsa tst@test1 reboot 
hello
$

Answer 2

You have create an account with nologin shell on that "main" machine. For that account you should generate ssh keys which can be used for remote login on machine which should be shutdown.

nologin shell will prevent login on that account, but it still can be used for remote login on other system.

To login as user with nologin shell you'll have to use su - user_name -s /bin/bash

My point is that the 'main' machine will automatically shutdown remote servers, without human interaction.

Answer 3

You can specify a forced command associated with a given public key in the authorized keys file. See the section 'AUTHORIZED_KEYS FILE FORMAT' of man sshd.

command="command"
    Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored....

You can also use the no-pty option on the key to disallow pty allocation.

Answer 4

You can do it the other way around: setup a scheduled task to check if the machine connected by USB to the UPS is online from the machines that has to be shutdown, if the machine connected to the UPS is offline a certain number of time in a row. As the machine will use a local account to run the scheduled task, no password or certificate will be required to do the task. If the machine replies to pings, it could be as easy as checking if you get a reply from the ping.

Another method would be to use KVM to initiate the shutdown, as if the power button was pressed. Depending on the machine settings, pressing the power button will just initiate the normal shutdown operation, or put the machine to suspend to disk.

I don't know a method to log to a remote machine without some sort of authentification unless leaving an account open to the wind or using a security flaw, a backdoor.

While this is not the method you asked to do the task, it is a method that will work to get your goals accomplished.