0

I'm working on an ssh server where the only thing I ever want the user doing is

ssh user@ip cat somefile

Part of my threat mitigation plan was to give the user restricted bash

I've seen examples with chsh rbash but on my server rbash was not found. So I made a script "rbash"

    #!/bin/bash
    bash -r

bash -r is an option to launch the restricted shell, so I put this script in /bin. and ran chsh user -s /bin/rbash

Now I can ssh user@ip into the server and find myself in a restricted shell, but when I try to ssh user@ip cat somefile the ssh process gets stuck at debug1: sending command: cat somefile

Am I going about this the right way? When I ssh to login in I can cat somefile, how do I make the command work remotely and keep the restricted shell?

Other possibly relevant info

  • Os Fedora 29
  • ssh auth method public key
2

Create rbash

If you scroll all the way down in the bash man page you find the chapter RESTRICTED SHELL:

If bash is started with the name rbash, or the -r option is supplied at invocation, the shell becomes restricted.

To start bash wit the name 'rbash', you could crate a symlink ln -s /bin/bash /bin/rbash.

Restrict user to cat somefile

From man authorized_keys:

command="command"
    Specifies that the command is executed whenever this key is used for
    authentication.

You could adjust your authorized_key file:

command="cat somefile" KEY_TYPE KEY COMMENT

Now this user key combo can only run cat somefile.

Why your wrapper doesn't work

Your script runs bash -r and it doesn't execute your command cat somefile. You can see what happens when you put set -xe in your script:

#!/bin/bash
set -xe
bash -xer

That shows that bash is not stuck but waiting for input and that you did spawn two shells. It has no prompt but can execute commands:

$ ssh user@ip cat somefile
+ /bin/bash -r

ls 
+ ls
somefile
exit
+ exit
exit
+ exit
$

You could pipe the command to this shell, but this is not a good solution:

ssh user@ip <<< 'cat somefile'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.