لطفا منتظر باشید ...
Recipe 5.19 Running root Commands via SSH
5.19.1 Problem
You want to grant root privileges to
another user, but permit only certain commands to be run.
5.19.2 Solution
Share your root privileges via SSH [Recipe 5.18] and
add forced commands to
~root/.ssh/authorized_keys.
5.19.3 Discussion
Using SSH forced commands, you can limit which
programs a user may run as root. For example, this key entry:
~root/.ssh/authorized_keys:
command="/sbin/dump -0 /local/data" ssh-dss key...
permits only the command /sbin/dump -0 /local/data
to be run, on successful authentication.Each key is limited to one forced command, but if you make the
command a shell script, you can restrict users to a specific set of
programs after authentication. Suppose you write a script
/usr/local/bin/ssh-switch:
#!/bin/sh
case "$1" in
backups)
# Perform level zero backups
/sbin/dump -0 /local/data
;;
messages)
# View log messages
/bin/cat /var/log/messages
;;
settime)
# Set the system time via ntp
/usr/sbin/ntpdate timeserver.example.com
;;
*)
# Refuse anything else
echo 'Permission denied' 1>&2
exit 1
;;
esac
and make it a forced command:
~root/.ssh/authorized_keys:
command="/usr/local/bin/ssh-switch $SSH_ORIGINAL_COMMAND" ssh-dss key...
Then users can run selected commands as:
$ ssh -l root localhost backups Runs dump
$ ssh -l root localhost settime Runs ntpdate
$ ssh -l root localhost cat /etc/passwd Not authorized: Permission denied
Take care that your forced commands use full paths and have
no shell escapes, and do not let the user modify
authorized_keys. Here's a bad
idea:
~root/.ssh/authorized_keys: DON'T DO THIS!!!!
command="/usr/bin/less some_file" ssh-dss key...
since less has a shell escape.
5.19.4 See Also
ssh(1), sshd(8), sshd_config(5).
