0

I have a remote script that I execute locally with ssh user@host "bash /path/to/remote/script.sh".

I don't want this script to run if it's executed directly from a remote shell, but only when executed locally via SSH. I considered passing the script a value like ssh user@host "bash /path/to/remote/script.sh local" and the script exiting if $1 was not local, but is there a more reliable way to test this?

Many thanks, Steve.

1
  • Can you edit your question to say why you want to run the script only via ssh? – Jim L. Sep 20 '19 at 17:05
2

You could check if the process name of the script's parent pid matched sshd.

e.g. somewhere early in the script (immediately after the #! line is a good place):

#!/bin/bash

if [ "$(ps h -o comm -p "$PPID")" != "sshd" ] ; then 
  echo "This script can only be run directly from ssh." > /dev/stderr
  exit 1
fi

This uses bash's built-in readonly variable "$PPID". It is automatically defined in every instance of bash.

Note that this is kind of pointless because anyone with read access to the script can just copy it and remove these few lines. The same will be true no matter what method the script uses to attempt this.

Also, process names are easily faked. It would be easy to write a wrapper script that set its process name to be sshd before running your script.


If your concern is that other users may run your script, have you considered setting the permissions on the script so that only the script's owner can read or execute it? (e.g. chmod 700 /path/to/script)

3
  • Good answer. Seems to me that setting up a user just to own that script could work, with sshd configured to run that script when a certain key is used to connect. I’m curious if you considered mentioning that and noticed a flaw in the idea, or...? – Wildcard Sep 20 '19 at 5:04
  • 1
    @Wildcard yeah, that's viable. I thought it was probably too much trouble to set up for just one script. and more hassle to specify the right key when the OP wants to run the script. – cas Sep 20 '19 at 5:08
  • Thanks everyone. All interesting ideas. @Wildcard, I was going with storing the script locally on the machine I'm ssh-ing from as @Jim L. mentioned, but I like the idea of setting-up a user to own the script. And using IdentityFile ~/.ssh/%h/%r/id_ed25519 in my local ssh config file I needn't worry about having to specify the correct key when wanting to run the script as @cas mentioned. – tech-otaku Sep 20 '19 at 7:31
1

A rather poor, low-resolution way to do this would be to test for the presence of SSH session variables:

SSH_CLIENT='10.10.11.11 48052 22'
SSH_CONNECTION='10.10.11.11 48052 10.20.30.40 22'
SSH_TTY=/dev/pts/2

However, an untrusted user on the remote machine could easily forge such variables and then run the script.

The best way I can think of to ensure that the script cannot be run in a native shell on the remote machine is to not store the script on the remote machine. Instead, store it locally on the machine you're ssh-ing from:

ssh user@host bash < /local/path/to/script.sh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.