Remote Commands and Restricted Shells via SSH

Question

I'm working on an ssh server where the only thing I ever want the user doing is

ssh user@ip cat somefile

Part of my threat mitigation plan was to give the user restricted bash

I've seen examples with chsh rbash but on my server rbash was not found. So I made a script "rbash"

    #!/bin/bash
    bash -r

bash -r is an option to launch the restricted shell, so I put this script in /bin. and ran chsh user -s /bin/rbash

Now I can ssh user@ip into the server and find myself in a restricted shell, but when I try to ssh user@ip cat somefile the ssh process gets stuck at debug1: sending command: cat somefile

Am I going about this the right way? When I ssh to login in I can cat somefile, how do I make the command work remotely and keep the restricted shell?

Other possibly relevant info

• Os Fedora 29
• ssh auth method public key

Answer 1

Create rbash

If you scroll all the way down in the bash man page you find the chapter RESTRICTED SHELL:

If bash is started with the name rbash, or the -r option is supplied at invocation, the shell becomes restricted.

To start bash wit the name 'rbash', you could crate a symlink ln -s /bin/bash /bin/rbash.

Restrict user to cat somefile

From man authorized_keys:

command="command"
    Specifies that the command is executed whenever this key is used for
    authentication.

You could adjust your authorized_key file:

command="cat somefile" KEY_TYPE KEY COMMENT

Now this user key combo can only run cat somefile.

Why your wrapper doesn't work

Your script runs bash -r and it doesn't execute your command cat somefile. You can see what happens when you put set -xe in your script:

#!/bin/bash
set -xe
bash -xer

That shows that bash is not stuck but waiting for input and that you did spawn two shells. It has no prompt but can execute commands:

$ ssh user@ip cat somefile
+ /bin/bash -r

ls 
+ ls
somefile
exit
+ exit
exit
+ exit
$

You could pipe the command to this shell, but this is not a good solution:

ssh user@ip <<< 'cat somefile'