4 ms·
Probably. See my comment (and example repo) elsewhere about running any old binary when someone connects.
by codazoda 2y ago
Probably. See my comment (and example repo) elsewhere about running any old binary when someone connects.
- Borg3 2y agoOr you can just run IRC client on start. Just trap SIGINT and SIGTSTP, run simple or modified client that cannot do exec or escape to shell and you are done :)
- jagged-chisel 2y agoSpoiler: set the user’s shell to any old binary, like a chat app.
- semi-extrinsic 2y agoOr in the authorized_keys file, prepend the public key with a specified command. This is then the only command that the user can execute when logging in with that particular key. To wit: command="/usr/bin/foo" ssh-ed25519 AAAA....
- titaniumtown 2y agoi had no idea about that, thank you!
- kijin 2y agoI suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.
- fragmede 2y agoI'd recommend using https://github.com/gliderlabs/ssh https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.
- quackduck 2y agoI use a fork of that!