Restricted SSH access

[Vladimir Kovacevic]

Hi!
I'm working on embeded Fedora on Atmel and have a problem with 
restricting ssh access for user that log on to system.
The only privilege I want to give them is executing some programs that I 
wrote (permit any view on a system directories except /home/user_name).
I looked in /etc/ssh_config but did't find what I was looking wor. Also,
tried with assigning a user /bin/bash console with -r (restricted) 
parameter (set it up on /etc/passwd)
but then I couldn't log on with putty or WinSCP to system.
Any ideas for simple solution for my problem?

P.S. Somebody might ask why would somebody use ssh for that limited 
access. Answer is that it must be supported, project specifications...

Thx in advance!

Vlada

[Bill Davidsen]

Vladimir Kovacevic wrote:
>  Hi!
>  I'm working on embeded Fedora on Atmel and have a problem with 
>  restricting ssh access for user that log on to system.
>  The only privilege I want to give them is executing some programs that I 
>  wrote (permit any view on a system directories except /home/user_name).
>  I looked in /etc/ssh_config but did't find what I was looking wor. Also,
>  tried with assigning a user /bin/bash console with -r (restricted) 
>  parameter (set it up on /etc/passwd)
>  but then I couldn't log on with putty or WinSCP to system.
>  Any ideas for simple solution for my problem? 
Sure, remove login by password and only allow login by authentication, 
the limit the key used to one command, using "command=xxx" in the 
authorized_keys file (see man sshd). Now make that command a tiny "pick 
a command" interface you write in C, python, perl... so they connect 
using their individual key, and you allow them to do only what you you 
approve. Should take about two hours to actually do it, assuming you 
have the commands they run all written.
>  
>  P.S. Somebody might ask why would somebody use ssh for that limited 
>  access. Answer is that it must be supported, project specifications...
>  
>  Thx in advance!
>  
>  Vlada
>   

-- 
Bill Davidsen <davidsen(a)tmr.com&gt;
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot

[John Summerfield]

Alan Cox wrote:
> > tried with assigning a user /bin/bash console with -r
> (restricted) 
> > parameter (set it up on /etc/passwd)
> > but then I couldn't log on with putty or WinSCP to system.
> > Any ideas for simple solution for my problem?
> >
> > P.S. Somebody might ask why would somebody use ssh for that limited 
> > access. Answer is that it must be supported, project specifications...
>  
>  Firstly the shell in /etc doesn't include an argument setting so you want
>  to run /bin/rbash (and link bash to rbash)
>  
>  Secondly you'll need to carefully set up your apps to have no holes
>  
>  Thirdly make sure that they cant redirect into their own home directory
>  files (make the dir r/o and the files r/o)
>  
>  Finally if you want them to use things like ftp you'll need to
>  put /bin/rbash into /etc/shells. You may well not want to do that bit of
>  course.
>  
>  Alan
>   
You might also look at hacking on busybox.

-- 

Cheers
John

-- spambait
1aaaaaaa(a)coco.merseine.nu  Z1aaaaaaa(a)coco.merseine.nu
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375

Please do not reply off-list

[Alan Cox]

>  tried with assigning a user /bin/bash console with -r (restricted) 
>  parameter (set it up on /etc/passwd)
>  but then I couldn't log on with putty or WinSCP to system.
>  Any ideas for simple solution for my problem?
>  
>  P.S. Somebody might ask why would somebody use ssh for that limited 
>  access. Answer is that it must be supported, project specifications... 
Firstly the shell in /etc doesn't include an argument setting so you want
to run /bin/rbash (and link bash to rbash)

Secondly you'll need to carefully set up your apps to have no holes

Thirdly make sure that they cant redirect into their own home directory
files (make the dir r/o and the files r/o)

Finally if you want them to use things like ftp you'll need to
put /bin/rbash into /etc/shells. You may well not want to do that bit of
course.

Alan

[Les Mikesell]

Vladimir Kovacevic wrote:
>  Hi!
>  I'm working on embeded Fedora on Atmel and have a problem with 
>  restricting ssh access for user that log on to system.
>  The only privilege I want to give them is executing some programs that I 
>  wrote (permit any view on a system directories except /home/user_name).
>  I looked in /etc/ssh_config but did't find what I was looking wor. Also,
>  tried with assigning a user /bin/bash console with -r (restricted) 
>  parameter (set it up on /etc/passwd)
>  but then I couldn't log on with putty or WinSCP to system.
>  Any ideas for simple solution for my problem?
>  
>  P.S. Somebody might ask why would somebody use ssh for that limited 
>  access. Answer is that it must be supported, project specifications...
>  
If you don't want someone to see the system directories, you have to 
build a chroot environment and keep them there.

http://www.howtoforge.com/chroot_ssh_sftp_fedora7

-- 
   Les Mikesell
    lesmikesell(a)gmail.com