I'd like to use a passwordless key to perform e.g. unison synchronization while being able to SSH into the server only with a password-protected key. The usual way of using scponly
is changig the login-shell of my server account, but that is too global. Can an entry in authorized_keys
achieve this instead?
1 Answer
You can use command
keyword in authorized_keys to restrict execution to one single command for particular key, like this:
command="/usr/local/bin/mysync" ...sync public key...
Update: If you specify a simple script as the command you may verify the command user originally supplied:
#!/bin/sh
case "$SSH_ORIGINAL_COMMAND" in
/path/to/unison *)
$SSH_ORIGINAL_COMMAND
;;
*)
echo "Rejected"
;;
esac
-
Doesn't that simply execute that command? I'd like sshd to only allow a
ssh server -c unison ...
while any other attempt to connect with that key should not execute anything but simple refuse connecting Nov 14, 2012 at 8:32 -
It is possible, I updated the answer. But what the reason for such behavior? If you have the key you have permission to sync. So you rather connect and do the job or don't connect at all... Nov 14, 2012 at 9:13
-
Perfect, I used
case "$(basename $SSH_ORIGINAL_COMMAND)" in \n unison *)
though. The reason is I want to have a private key that doesn't require a password so unison can run unattended (e.g. as a cronjob), while that key should not be capable of allowing a SSH access. Of course unison could be abused to replaceauthorized_keys
... Nov 14, 2012 at 9:28