Is there a way to create a user account in Solaris which allows the users to run one command only? No login shell or anything else. I could possibly do it with /usr/bin/false in /etc/passwd and just get the user to ssh <hostname> <command>, but is there a nicer way to do it?


You could used a forced command if the users can only connect through ssh. Essentially, whenever the user connects through ssh with a certain key and a certain username, you force him to execute a command (or a script or) you determined in the .ssh/authorized_keys. Commands issued by the users will be ignored.

For example:

# in .ssh/authorized_keys
command="cd /foo/bar && /path/to/scripts/my_script.sh arg1 arg2",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa public_key
| improve this answer | |
  • Well you were both right. What I done was created a script which supplies a menu on the prompt and used the forced check command in .ssh/authorized_keys on the server in front of the key for the authorized user. This now enables him to ssh to the server and at the prompt is given a nice menu with several commands to execute. Nothing else can be run. Happy days! – Will Dowling Oct 29 '10 at 12:44
  • 2
    Edited; you need these options to secure a forced command: "no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty". – Tobu Apr 17 '13 at 11:00

You could set the shell of that user to a script just running the command you want to allow: Whenever the user logs in, the command is run, then the user is logged out. And since there's no "full shell" you don't have to deal with the user trying funky stuff ;)

| improve this answer | |

I'm wondering if you could do this with RBAC and giving the user a privileged shell (pfsh, pfcsh, or pfksh) and creating a profile for the commands the user(s) would be allowed to run.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.