Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 5 down vote favorite
1

Is there a way to create a user account in Solaris which allows the users to run one command only? No login shell or anything else. I could possibly do it with /usr/bin/false in /etc/passwd and just get the user to ssh <hostname> <command>, but is there a nicer way to do it?

share|improve this question

2 Answers

up vote 5 down vote accepted

You could used a forced command if the users can only connect through ssh. Essentially, whenever the user connects through ssh with a certain key and a certain username, you force him to execute a command (or a script or) you determined in the .ssh/authorized_keys. Commands issued by the users will be ignored.

For example:

# in .ssh/authorized_keys
command="cd /foo/bar && /path/to/scripts/my_script.sh arg1 arg2",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa public_key
share|improve this answer
Well you were both right. What I done was created a script which supplies a menu on the prompt and used the forced check command in .ssh/authorized_keys on the server in front of the key for the authorized user. This now enables him to ssh to the server and at the prompt is given a nice menu with several commands to execute. Nothing else can be run. Happy days! – Will Dowling Oct 29 '10 at 12:44
Edited; you need these options to secure a forced command: "no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty". – Tobu Apr 17 at 11:00
up vote 8 down vote

You could set the shell of that user to a script just running the command you want to allow: Whenever the user logs in, the command is run, then the user is logged out. And since there's no "full shell" you don't have to deal with the user trying funky stuff ;)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.