I would like to create a ci user on a device to allow for a pipeline to drop a file into a single directory only.
I have created a user using:
useradd -M -N -r -s /bin/false devops
chown -R devops /var/file-drop/
For authentication, I have the following line in my
and have added a file called
devops with content
devops in the authorized_principals directory.
My question is: excluding any 0-day vulnerabilities and such, does the above setup actually achieve my goal of allowing a user with that principal only access to dropping a file in
/var/file-drop? Or am I inadvertently opening up other attack surfaces by doing this?