6

Possible Duplicate:
Creating a UNIX account which only executes one command

There is a shell script which has to be executed through an existing user account XXX. Now I have various other users which shall be able to execute only this script as well without getting access to the user account XXX. Is there a way to create a ssh command (maybe through a key or anything else), which only allows to execute this specific shell script of the user XXX without knowing the password of XXX?

Community
  • 1
user29866
  • 63

1 Answers1

10

If running the script is the only thing you want those other users to be able to do, then I'd go with using ssh keys.

Each user should have their own ssh key, so you won't get into a hassle when somebody no longer needs access. The public part of the key should be put into

~scriptuser/.ssh/authorized_keys

and in front of the actual key, you should add the text command="/path/to/script"

Here's an example:

from="10.23.5.32",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/path/to/script"  ssh-dss A........

This limits the ip-address that this key can be used from, and it limits what kind of forwarding can be done, and makes sure that no pty can ever be granted when using this key, and whenever the user connects with this key then the script will be run and nothing else can happen.

To add an environment variable, you just add it too to the key:

from="10.23.5.32",environment="MYVARIABLE=whatever",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/path/to/script"  ssh-dss A........

However, in order for that to work, you have to have the PermitUserEnvironment directive set to "yes" in the sshd config file. If you can't make that happen, you can instead change the line to this:

from="10.23.5.32",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="export MYVARIABLE=whatever; /path/to/script"  ssh-dss A........
Jenny D
  • 13,172
  • I guess that's what I need. I will give it a try. Thanks! – user29866 Jan 07 '13 at 16:05
  • Just one more question, when a need a variable for the shell script, how do I forward it with ssh and how will look the example command part in the file authorized_keys? – user29866 Jan 07 '13 at 16:37
  • I'm adding that info to the answer. – Jenny D Jan 08 '13 at 08:06
  • I referred to the command. Here my shell script needs variables. So I can't specify them already in authorized_keys. Now I changed my script and read them with $SSH_ORIGINAL_COMMAND. – user29866 Jan 08 '13 at 16:25
  • What if I don't have a static IP address? Can I just say that a specific public-key should only execute a certain script? – Matt Oct 02 '20 at 12:48
  • 1
    @MattiaRighetti sure, you can leave that part out if your circumstances require. In that case, just remove everything up to and including the first comma. – Jenny D Oct 03 '20 at 13:32