LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-18-2019, 10:11 AM   #31
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 3,913
Blog Entries: 3

Rep: Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862

Quote:
Originally Posted by jca002 View Post
I have gotten around this now by checking the value of ${SHELL} and if it is /bin/ksh then I have to do (exec -a "-ksh" ${SHELL}) and if ${SHELL} is /bin/bash then I have to do (exec -l ${SHELL}).
You should be able to get a login-type shell using the following:

Code:
ForceCommand=exec ${SHELL} -l
All three, bash, ksh, and zsh, accept the -l option and should behave the same way with that. However, as-is, that will interfere with SFTP.

Edit: this gets a little closer:

Code:
ForceCommand=/usr/lib/openssh/sftp-server || exec ${SHELL} -l
They must first type something throwaway to get to the shell. However, it suggests there is a solution.

Last edited by Turbocapitalist; 05-18-2019 at 10:19 AM.
 
Old 05-18-2019, 10:16 AM   #32
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 12,598

Rep: Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937
probably helpful: https://stackoverflow.com/questions/...-without-shell
 
Old 05-18-2019, 10:23 AM   #33
jca002
LQ Newbie
 
Registered: May 2019
Posts: 12

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Turbocapitalist View Post
You should be able to get a login-type shell using the following:

Code:
ForceCommand=exec ${SHELL} -l
All three, bash, ksh, and zsh, accept the -l option and should behave the same way with that. However, as-is, that will interfere with SFTP.

Edit: this gets a little closer:

Code:
ForceCommand=/usr/lib/openssh/sftp-server || exec ${SHELL} -l
They must first type something throwaway to get to the shell. However, it suggests there is a solution.
The man page for ksh does not show the -l as a valid option. It indicates -a should be used.
 
Old 05-18-2019, 10:26 AM   #34
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 12,598

Rep: Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937Reputation: 3937
base on the man page -l is available for ksh too. You may have a different version.
Does it really important?
 
Old 05-18-2019, 10:28 AM   #35
jca002
LQ Newbie
 
Registered: May 2019
Posts: 12

Original Poster
Rep: Reputation: Disabled
Thanks for all the suggestions.

I think I have come up with a solution that works for me and if someone else ever has this requirement, hopefully my solution will help them.

In /etc/ssh/sshd_config I added (ForceCommand /usr/libexec/openssh/forcecommand). This is a ksh script which is below.

Quote:
#!/bin/ksh
##

if [ "${SSH_ORIGINAL_COMMAND}" = "" ]
then
if [ "${SHELL}" = "/bin/ksh" ]
then
exec -a "-ksh" ${SHELL}
fi
if [ "${SHELL}" = "/bin/bash" ]
then
exec -l ${SHELL}
fi
exec ${SHELL}
fi
if [ "${SSH_ORIGINAL_COMMAND}" = "/usr/libexec/openssh/sftp-server" ]
then
exec /usr/libexec/openssh/sftp-server
fi
echo
echo "Permission denied"
echo "Bye"
echo
exit 1
I could not figure out how to make the above script keep the indents when posting. While editing it looks like I wanted it to, but after posting all indents are removed.

Last edited by jca002; 05-18-2019 at 10:41 AM. Reason: Quuoted script to keep indents
 
Old 05-18-2019, 10:30 AM   #36
Turbocapitalist
Senior Member
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 3,913
Blog Entries: 3

Rep: Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862Reputation: 1862
Ksh version 93u+20120801-3.1 on devuan accepts -l for login effects.

I see a way with the ${SSH_ORIGINAL_COMMAND} to launch either exec ${SHELL} -l or else /usr/lib/openssh/sftp-server. If your Subsystem SFTP is set to /usr/lib/openssh/sftp-server then SSH_ORIGINAL_COMMAND will contain that when people try to connect with SFTP. So your wrapper script can be quite short and might contain a single if-then-else statement.

Edi: too slow

Last edited by Turbocapitalist; 05-18-2019 at 10:32 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
can't restrict sshd access through hosts.allow and hosts.deny but was working earlier farhan Linux - Security 4 04-18-2008 07:41 AM
Starting sshd: /etc/init.d/sshd: line 113: /usr/sbin/sshd: Permission denied sumanc Linux - Server 5 03-28-2008 04:59 AM
FC4-Starting sshd: Privilege separation user sshd does not exist FAILED kiranherekar Fedora 5 12-29-2005 02:22 PM
sshd restrict connections introuble Linux - Security 1 07-01-2005 07:57 AM
Enabling SSH in mandrake 9.2 - sshd vs. sshd-xinetd DogTags Linux - Newbie 7 11-25-2003 12:17 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:10 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration