LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 06-07-2012, 08:49 PM   #1
Jerry Mcguire
Member
 
Registered: Jul 2009
Location: Hong Kong SAR
Distribution: RedHat, Fedora
Posts: 201

Rep: Reputation: 31
To limit ssh commands while enabling scp


Hi all,

I have two linux machines, one as server and one as client. The client needs to invoke commands on the server through ssh. e.g

Code:
user@client$  ssh oper@server cat /etc/passwd

user@client$  scp myfile oper@server:/myfile
SSH authentication is already done by key exchange, so the above are working as expected so far.

Then the server implements more security measures, to limit the commands through ssh:

Code:
oper@server$ cat ~/.ssh/authorized_keys 
command="exec sh ~/.ssh/limited-commands.sh" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAn9keRyErfNWyIiScLWvVroO .... ....

oper@server$ cat ~/.ssh/limited-commands.sh
#!/bin/sh
arg1=${SSH_ORIGINAL_COMMAND%% *}
case $arg1 in
cat )
	exec $SSH_ORIGINAL_COMMAND
	;;
esac
Now ssh with cat still works, but scp doesn't. Is there any way to make both work?

Thank you.
 
Old 06-08-2012, 02:03 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
Well I'd never heard of SSH_ORIGINAL_COMMAND, if I only learn one thing today.... ace!

So it looks like you just need to permit the execution of scp on the other end of the connection too, just like any other command being executed under this restriction:

http://www.linuxquestions.org/questi...ommand-686646/
 
Old 06-13-2012, 01:47 AM   #3
Jerry Mcguire
Member
 
Registered: Jul 2009
Location: Hong Kong SAR
Distribution: RedHat, Fedora
Posts: 201

Original Poster
Rep: Reputation: 31
Unhappy

Thank you. But the suggestions in the other post won't work.

Unlike "ssh", the command "scp" makes sense only in the client's context.

Code:
scp ~/file oper@server:~/
may run correctly in the client side because 'file' is on the client's home. Running the same in the server's prompt is totally wrong.

"ssh oper@server command arg arg ..." instructs the 'server' to execute some command by the 'oper' a/c; while
"scp file oper@serverath" is a different thing.

I guess this remains unsolved...
 
Old 06-13-2012, 02:06 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
As I understood it, scp runs on both sides in order to allow the transfer to work, between the two points. You can't scp anything to a remote location with scp installed remotely, i don't think. I just tested it to see if I could see scp running on a remote server when scping to it though, and I can't so maybe I'm totally wrong about that. ho hum.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] ssh scp key not working to ssh/scp without password anon091 Linux - Newbie 9 08-22-2011 04:28 PM
limit bandwidth rate for scp using tc htb Linux abhelp Linux - Networking 9 08-20-2010 09:45 AM
Chroot SSH problem: ssh working, not SFTP & SCP. NaCo Linux - Security 3 02-01-2009 02:23 AM
enforce a bandwidth limit for scp per user lothario Linux - Networking 1 06-29-2008 02:00 PM
Limit the access to user connectiing through SCP Menestrel Linux - Newbie 4 07-14-2005 04:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 04:45 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration