4 ms·
For anybody who's wondering why I chose to post this: I found this while Googling around trying to answer the question "how hard is it to write a custom shell,
by mindcrime 6y ago
For anybody who's wondering why I chose to post this: I found this while Googling around trying to answer the question "how hard is it to write a custom shell, and how would you get started?" The reason I wanted to know that is this: I've always been intrigued by the idea of making "things" ( hand-waving around the details of what that means) available via ssh. Imagine something like a MUD, except not a MUD exactly. Just the idea of "You login to a server and you're immediately dropped into some program that provides $EXPERIENCE."
For the longest time I thought the "way to do that" probably involved some crazy sshd config or something, but then the penny dropped and I realized "Well shit, you could just make it a shell and set the user's shell entry to that program. Duh."
If somebody knows a better approach to that sort of thing, I'd love to hear about it. But for now I'm content that I've found an approach that seems workable.
(and if you're wondering more: No, this isn't anything interesting, or a startup project, or anything you'd probably even see on Show HN. It's just an example of the kind of random crap I think about in between doing other things.)
- 1vuio0pswjnm7 6y agoI used to think about a similar ideas. Because it should be possible to ssh to programs other than a "full-featured" shell (despite the "sh" in ssh). One idea was something like OpenBSD's auth-pf. The program might have only one purpose and one capabaility, e.g., to ephemerally open a port in the firewall. Then the user would access whatever remote program she wanted to access through that port, maybe opened briefly just for her.
- shadowofneptune 6y agoI have seen "things" served using telnet. In this example, it's a mod for a game that allows for virtual machines to run inside the game, and then has a telnet server that allows you to access them from outside the game. It has a login utility that runs at the start, listing the available virtual machines. https://github.com/KSP-KOS/KOS/blob/develop/src/kOS/UserIO/TelnetMainServer.cs https://github.com/KSP-KOS/KOS/blob/develop/src/kOS/UserIO/T... Unfortunately, it appears the solution was to write an entirely custom telnet server. Author also says in the included documentation that SSH was the original plan but implementing all of SSH is far too complicated.
- stock_toaster 6y agoUsing "command=" in authorized_keys is one way. I've used this to restrict a certain ssh key pair to only using allowing a few simple commands via a wrapper-shell script. A couple of succinct examples I found via a quick google: https://www.virtono.com/community/tutorial-how-to/restrict-executable-ssh-commands-with-authorized-keys/ https://www.virtono.com/community/tutorial-how-to/restrict-e... https://ctrlnotes.com/restrict-a-user-to-ssh-forced-command/# https://ctrlnotes.com/restrict-a-user-to-ssh-forced-command/... You could also use Match in sshd_config and ForceCommand too.
- mindcrime 6y agoAwesome. That's good stuff. I had figured there was a way to do with sshd configuration, but my (admittedly limited) initial Googling had not turned up anything. The "command=" thing seems pretty cool, since you can have a separate command for each certificate. I can see how that would be really useful.
- tal8d 6y agoI wrote a curses scheduling application for warehouse managers and essentially just set it as their login shell to a machine that only did timesheet stuff. No complaints and no problems for all the years it ran. Of course... they were already doing a lot of their work in a 5250 terminal emulator - and probably just assumed they were talking to an AS/400 instead of a headless disused Dell workstation. Don't get hung up on the shell thing, you only need to think about env variables, stdin/stdout, and maybe termcap/terminfo (depending on how fancy you want to get).
- mindcrime 6y agoI wrote a curses scheduling application for warehouse managers and essentially just set it as their login shell to a machine that only did timesheet stuff. Funny you would mention that... using a curses or TurboVision based TUI app is kinda what I was thinking about that inspired this hole avenue of exploration.
- nanis 6y agoWhen I was a grad student, the entire campus was able to log in to their email by telneting to a well known host. Upon log in, you were dumped in to Pine. Innocent times.
- pysxul 6y agoHello. great article! I remember making one back in Uni. We implemented an LL parser it was fun. IT really starts to get tricky when you implement Pipes/Redirections and the parenthesis () operators. have fun hacking
- blackrock 6y agoIs this like creating your own Bash shell?
- guerrilla 6y agoNice work. Do you think you might do a follow-up adding redirection and pipes? Then a third with job control? ;)
- aufhebung 6y agoI'm pretty sure something similar is done on nethack@alt.org
- txdv 6y agoHad a course on Unix, one of the assignments was to create shell with pipes. I was surprised how simple it was: just fork all the programs between the pipes and link the output of one to the input of the other.