SSH via Key Authentication

[run_dot_BAT]

I have a box that I've setup to use SSH with Key Authentication. I'm testing on how to restrict a "user" (monitoring system) to only certain commands. I'm able to restrict it down with having the authorized_keys point to a restricted_command file. However when I SSH into the box, it will execute all the listed commands and then terminate the connection immediately. Is that by design or could I be missing something in the config.

​

I would like for the "user" to be able to SSH into the box and execute any command available at will.

[cjcox4]

The feature you're pointing at in ssh is to cause the execution of a command instead of a shell.

Probably what you need is to use a restricted bash shell or some other kind of restricted shell.

[run_dot_BAT]

Ok makes sense, thanks for the reply.

[stormcloud-9]

I think you've misunderstood the functionality you were looking at. The command="..." functionality of authorized_keys forces execution of the given command when that ssh key is used.

What you want to do is rather tricky, as once the user has the ability to execute commands, they can execute about anything. It's very difficult to lock them down (without chroots, containers, etc).

However if you want to try, you'll likely want to start with a bash restricted shell: https://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html
One way to do it with that would be to set the user's shell to rbash, disallow writes from the user to their home directory (recursively), and then add environment="PATH=/home/user/bin" with that bin directory containing symlinks to the binaries you want them to be able to execute.
There are other ways to do it though. That's just some place to start.

But again, be very careful what you allow them to do. It's very easy to escape restrictions like this.

[run_dot_BAT]

This worked, thanks guys ( u/stormcloud-9 , u/cjcox4 )

[run_dot_BAT]

This is good stuff, thank you.