3 ms·
Spoiler: set the user’s shell to any old binary, like a chat app.
by jagged-chisel 2y ago
Spoiler: set the user’s shell to any old binary, like a chat app.
- semi-extrinsic 2y agoOr in the authorized_keys file, prepend the public key with a specified command. This is then the only command that the user can execute when logging in with that particular key. To wit: command="/usr/bin/foo" ssh-ed25519 AAAA....
- titaniumtown 2y agoi had no idea about that, thank you!
- kijin 2y agoI suppose this will also lock the user out of sftp and scp? Because otherwise they might be able to edit the authorized_keys file and run any command.
- fragmede 2y agoI'd recommend using https://github.com/gliderlabs/ssh https://github.com/gliderlabs/ssh instead, no chance of some shell escape that way.
- quackduck 2y agoI use a fork of that!