3 ms·
Question: What happens when you type `ssh git@github.com /bin/bash`? That command doesn't use the shell set in /etc/passwd at all, and you authenticate success
by Hello71 14y ago
Question: What happens when you type `ssh git@github.com /bin/bash`?
That command doesn't use the shell set in /etc/passwd at all, and you authenticate successfully, so it must give you a shell, right? No.
- teraflop 14y ago> That command doesn't use the shell set in /etc/passwd at all Yes it does. https://github.com/SimonWilkinson/openssh/blob/master/session.c#L1815 https://github.com/SimonWilkinson/openssh/blob/master/sessio...
- Hello71 14y agoRegardless: AUTHORIZED_KEYS FILE FORMAT .... command="command" Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored. The command is run on a pty if the client requests a pty; otherwise it is run without a tty. If an 8-bit clean channel is required, one must not request a pty or should specify no-pty. A quote may be included in the command by quoting it with a backslash. This option might be useful to restrict certain public keys to per‐ form just a specific operation. An example might be a key that per‐ mits remote backups but nothing else. Note that the client may specify TCP and/or X11 forwarding unless they are explicitly prohib‐ ited. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Note that this option applies to shell, command or subsystem execution. Also note that this command may be superseded by either a sshd_config(5) ForceCommand directive or a command embedded in a certificate.
- deleted 14y ago[deleted]
- __david__ 14y agoGot it, so the shell is still /bin/bash but they specify the command in the .ssh/authorize_keys file which means it cannot be overridden by the user. (I was under the mistaken impression that gitolite overrode the shell and not the command) So your original point was correct: as long as the authorized_keys file is not corrupted, everything is good. Thanks for helping me understand!
- sytse 14y agoYou can find the commands that are allowed in the GitLab-shell here https://github.com/gitlabhq/gitlab-shell/blob/master/lib/gitlab_shell.rb#L42 https://github.com/gitlabhq/gitlab-shell/blob/master/lib/git...