3

I have learned a lot today messing around with ssh with RSA and creating system user accounts with no password, no login etc etc. What I was trying to do was create a user with a home directory needed for ~/.ssh/ and a password (needed for initial ssh setup)

But I can't seem to get it set-up correctly.

I know about using

ssh-keygen
ssh-copy-id user@remotehost

This is simple for RSA

and I know how to create a user with say

useradd -r newuser

OR

adduser newuser --system --shell=/bin/false
passwd newuser
passwd -d newuser
  • The End Goal

    is a user who doesn't have a shell, or atleast can't be logged into from a remote computer, but can still be used to ssh over to another computer and run a command. Is this even possible?

  • The REASON/GOAL

    is to have a user whom when the ups runs low on power, shuts down the other connected computers via ssh before shutting down the main computer. (Only one computer can connect to the UPS via USB at a time to monitor the stats).

I don't want people to be able to log in via SSH with the username UPS, but I need ups to be able to ssh into remotehost without password.

  • Have you considered using a key instead of a password ? This would not require any password as is, only to have the private certificate on the client. – Zulgrib Aug 17 '16 at 21:30
  • ssh-keygen and ssh-copy-id is for generating RSA keys and replicating public key to remote host... The idea is that the USER just won't have a system password at all. Nor a login shell, just the ability to ssh via rsa and then run the command "shutdown -h now" – FreeSoftwareServers Aug 17 '16 at 21:33
8

Set the crypt field to * or to !! in /etc/shadow

eg

# adduser tst  
# passwd -l tst
Locking password for user tst.
passwd: Success
# grep tst /etc/passwd
tst:x:1000:1000::/home/tst:/bin/bash
# grep tst /etc/shadow
tst:!!:17030:0:99999:7:::

At this point the user can not login because there's no valid password.

Now add a command="/thing/to/do" to the beginning of the public key in the authorized_keys file

eg

# ls -l $PWD/authorized_keys 
-rw-r--r-- 1 tst tst 431 Aug 17 17:54 /home/tst/.ssh/authorized_keys

# cat $PWD/authorized_keys
command="/bin/echo hello" ssh-rsa AAAAB3NzaC1yc2E....etcetc

Now this key can be used, but the only thing it can be used for is that forced command:

$ ssh -i ~/.ssh/id_rsa tst@test1
hello
Connection to test1 closed.

If you try to do anything else it'll fail, and still force the same command

$ ssh -i ~/.ssh/id_rsa tst@test1 reboot 
hello
$
  • This seems perfect! I've never herd of putting and command inside an Rsa key but that's perfect! I'll test then accept – FreeSoftwareServers Aug 17 '16 at 22:41
  • I love how this locks it down, even if somebody got ahold of the key, and ssh'd in, they would just shut down the computer :P, works great! – FreeSoftwareServers Aug 18 '16 at 16:58
  • 1
    You can also add a from="1.2.3.4" entry to it to restict the IP address the key can be used from; if someone got the key and tried to use it from any other machine then it'd fail. – Stephen Harris Aug 18 '16 at 17:00
  • Can I say wildcard that, like from="10.1.8.*"?, Also, If you are feeling up to a challenge, I posted this question in regards to cat'ing the line to the rsa key unix.stackexchange.com/questions/304287/… – FreeSoftwareServers Aug 18 '16 at 17:02
  • 1
    Yes, IP address patterns and DNS names can all be used. – Stephen Harris Aug 18 '16 at 17:10
1

You can specify a forced command associated with a given public key in the authorized keys file. See the section 'AUTHORIZED_KEYS FILE FORMAT' of man sshd.

command="command"
    Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored....

You can also use the no-pty option on the key to disallow pty allocation.

0

You can do it the other way around: setup a scheduled task to check if the machine connected by USB to the UPS is online from the machines that has to be shutdown, if the machine connected to the UPS is offline a certain number of time in a row. As the machine will use a local account to run the scheduled task, no password or certificate will be required to do the task. If the machine replies to pings, it could be as easy as checking if you get a reply from the ping.

Another method would be to use KVM to initiate the shutdown, as if the power button was pressed. Depending on the machine settings, pressing the power button will just initiate the normal shutdown operation, or put the machine to suspend to disk.

I don't know a method to log to a remote machine without some sort of authentification unless leaving an account open to the wind or using a security flaw, a backdoor.

While this is not the method you asked to do the task, it is a method that will work to get your goals accomplished.

  • That would definitely not work, way to high of a chance of a machine shooting itself in the head when there is no actual power outage, just some sort of network failure that would probably fix itself if left well alone. – FreeSoftwareServers Aug 18 '16 at 13:11
0

You have create an account with nologin shell on that "main" machine. For that account you should generate ssh keys which can be used for remote login on machine which should be shutdown.

nologin shell will prevent login on that account, but it still can be used for remote login on other system.

To login as user with nologin shell you'll have to use su - user_name -s /bin/bash

My point is that the 'main' machine will automatically shutdown remote servers, without human interaction.

  • Doesn't the su command requires you to be logged to the remote machine first ? – Zulgrib Aug 17 '16 at 21:50
  • That's correct, but you can use root account for that purpose. – HubertS Aug 17 '16 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.