Raymii.org

Table of Contents

• Purpose
• Installation / Usage
• Regexing / Safety
• Logging
• Other info
• Links

restrict ssh.sh is a bash script which restricts ssh for a user to a set of (flexible) commands via .ssh/authorized keys, and log it verbosely.

Recently I removed all Google Ads from this site due to their invasive tracking, as well as Google Analytics. Please, if you found this content useful, consider a small donation using any of the options below:

I'm developing an open source monitoring app called Leaf Node Monitoring, for windows, linux & android. Go check it out!

Consider sponsoring me on Github. It means the world to me if you show your appreciation and you'll help pay the server costs.

You can also sponsor me by getting a Digital Ocean VPS. With this referral link you'll get $200 credit for 60 days. Spend $25 after your credit expires and I'll get $25!

Purpose

I have a web application which needs to do some things over ssh on a server. It runs as a separate user, and this script allows me to restrict the commands it can execute as well. It however does allow regexes so filenames can be passed. It also logs the commands and session info.

Installation / Usage

Download the script from github, or clone the repository.

Put this script in the users home directory, or a directory which is accessible by that user.

Edit the allowed_commands array:

declare -a allowed_commands=('^ls -[l|d|a]$' 'ls -la' 'w' 'uptime' 'pwd' 'uname -a') 

Make sure that there are no comma's (,) between the options, otherwise it will fail.

Make it executable for that user: chown user:usergroup /home/user/restrict_ssh.sh and/or chmod +x /home/user/restrict_ssh.sh.

Modify the users ~/.ssh/authorized_keys file, and before the ssh key(s) put the line command="/home/user/restrict_ssh.sh" before the key. Like so:

command="/home/remy/restrict_ssh.sh" ssh-rsa AAAAB[...]X9t remy@macbookpro.raymii.nl

Optional: Disable password login for that user, edit /etc/ssh/sshd_config and add the following:

Match User remy
    PasswordAuthentication no

This will disable password logins only for user remy.

Regexing / Safety

The default setup has a regex command allowed. It is the ls command, and the regex allows either ls -l, ls -d or ls -a. If you know basic Perl style regexes you can be very creative with this, for example ^ping -c 4 [a-zA-Z0-9]{2,20}.(com|org|net)$ allows the command ping to be executed for any 2 to 20 character .com, .net or .org domain. domain and nothing else.

BE CAREFUL WITH THIS. IF YOU CONFIGURE IT WRONG USER MAY BE ABLE TO GET A SHELL (vim, :!bash) OR OVERWRITE THE .ssh/authorized keys FILE. IF YOU ARE NOT SURE, THEN DO NOT USE IT AT ALL!_

Also, if you allow vim, less, man, or any other program, a user might get a shell. If the program you allow includes the possibility to run a shell, this script/restriction is of no use.

Logging

By default it logs lines like these to syslog:

Jan 20 20:39:23 vps11 RESTRICTED_SSH[9015]: INFO: SSH Connection: 'x.x.x.x 32309 x.x.x.x 22'
Jan 20 20:39:23 vps11 RESTRICTED_SSH[9014]: INFO: SSH Client: 'x.x.x.x 32309 22'
Jan 20 20:39:23 vps11 RESTRICTED_SSH[9017]: INFO: SSH Username: 'remy'
Jan 20 20:39:23 vps11 RESTRICTED_SSH[9016]: INFO: SSH Shell: '/bin/bash'
Jan 20 20:39:23 vps11 RESTRICTED_SSH[9013]: INFO: Sent SSH command: 'vim'
Jan 20 20:39:23 vps11 RESTRICTED_SSH[9018]: ERROR: Command "vim" is not allowed.

Other info

I think it requires Bash 4+ because of the array search function. I have no bash lower than v4 to test it with.

Links

https://raymii.org/s/software/Restrict_SSH.html
https://github.com/RaymiiOrg/restrict_ssh

Tags: authorized_keys , bash , openssh , restricted , software , ssh