4 ms·
> And since the sshd approach doesn't allow you to restrict root access to only certain commands [...] The ForcedCommand infrastructure.
by blueflow 2y ago
> And since the sshd approach doesn't allow you to restrict root access to only certain commands [...]
The ForcedCommand infrastructure.
- flakes 2y agoThere's also a command argument that can be provided in the authorized keys setup, which can force connections with a particular key to hit an entry-point application.
- blueflow 2y agoThis is the ForcedCommand mechanism.
- bandie91 2y agonote, that even with ForcedCommand, sshd still executes ~/.ssh/rc in the user's name, so she can execute arbitrary command once she can write the rc file (unless disabled by PermitUserRC). shameless plug: you can prevent this by https://github.com/bAndie91/tools/tree/master/ssh-groupcommand https://github.com/bAndie91/tools/tree/master/ssh-groupcomma...