undefined | Better HN

0 pointsjagged-chisel1y ago0 comments

Spoiler: set the user’s shell to any old binary, like a chat app.

0 comments

Or in the authorized_keys file, prepend the public key with a specified command. This is then the only command that the user can execute when logging in with that particular key. To wit:

  command="/usr/bin/foo" ssh-ed25519 AAAA....

kijin1y ago

I suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.

gerdesj1y ago

"I suppose this will also lock the user out of sftp and scp?"

No it wont! The specified command might provide sftp, scp, telnet or stream a film.

1 more reply

titaniumtown1y ago

i had no idea about that, thank you!

fragmede1y ago

I'd recommend using https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.

quackduck1y ago

I use a fork of that!

j / k navigate · click thread line to collapse