[SOLVED] Restrict sshd to login only

Originally Posted by jca002 I have gotten around this now by checking the value of ${SHELL} and if it is /bin/ksh then I have to do (exec -a "-ksh" ${SHELL}) and if ${SHELL} is /bin/bash then I have to do (exec -l ${SHELL}).

You should be able to get a login-type shell using the following:

ForceCommand=exec ${SHELL} -l

All three, bash, ksh, and zsh, accept the -l option and should behave the same way with that. However, as-is, that will interfere with SFTP.

Edit: this gets a little closer:

ForceCommand=/usr/lib/openssh/sftp-server || exec ${SHELL} -l

They must first type something throwaway to get to the shell. However, it suggests there is a solution.

probably helpful: https://stackoverflow.com/questions/...-without-shell

Originally Posted by Turbocapitalist You should be able to get a login-type shell using the following: ForceCommand=exec ${SHELL} -l All three, bash, ksh, and zsh, accept the -l option and should behave the same way with that. However, as-is, that will interfere with SFTP. Edit: this gets a little closer: ForceCommand=/usr/lib/openssh/sftp-server || exec ${SHELL} -l They must first type something throwaway to get to the shell. However, it suggests there is a solution.

The man page for ksh does not show the -l as a valid option. It indicates -a should be used.

base on the man page -l is available for ksh too. You may have a different version.
Does it really important?

Thanks for all the suggestions.

I think I have come up with a solution that works for me and if someone else ever has this requirement, hopefully my solution will help them.

In /etc/ssh/sshd_config I added (ForceCommand /usr/libexec/openssh/forcecommand). This is a ksh script which is below.

#!/bin/ksh ## if [ "${SSH_ORIGINAL_COMMAND}" = "" ] then if [ "${SHELL}" = "/bin/ksh" ] then exec -a "-ksh" ${SHELL} fi if [ "${SHELL}" = "/bin/bash" ] then exec -l ${SHELL} fi exec ${SHELL} fi if [ "${SSH_ORIGINAL_COMMAND}" = "/usr/libexec/openssh/sftp-server" ] then exec /usr/libexec/openssh/sftp-server fi echo echo "Permission denied" echo "Bye" echo exit 1

I could not figure out how to make the above script keep the indents when posting. While editing it looks like I wanted it to, but after posting all indents are removed.

Ksh version 93u+20120801-3.1 on devuan accepts -l for login effects.

I see a way with the ${SSH_ORIGINAL_COMMAND} to launch either exec ${SHELL} -l or else /usr/lib/openssh/sftp-server. If your Subsystem SFTP is set to /usr/lib/openssh/sftp-server then SSH_ORIGINAL_COMMAND will contain that when people try to connect with SFTP. So your wrapper script can be quite short and might contain a single if-then-else statement.

Edi: too slow