Security implications of using Bash script as a SSH login shell

Question

I have a fairly simple monitoring implementation, let's say that the monitoring server connects to a target through SSH via key authentication, and fetches information according to a script set up as a login shell for the monitoring user.

ie. monitoring ---ssh---> target ---login-shell---> script argument

A sample login shell script could be as follows:

#!/bin/bash
if [ "$2" = "hello" ]; then
        echo "$(free -m)"
fi

And the data could be fetched as below:

[root@run ~]# ssh -i sshkey testuser@target hello
              total        used        free      shared  buff/cache   available
Mem:          15857        3086        1376         832       11394       11539
Swap:         16127           0       16127

testuser would have the bash script set as it's login shell:

testuser:x:1006:1007::/home/testuser:/home/testuser/init

Are there any obvious security problems with such an implementation? If presently not, what do I need to consider when expanding this to include more functionality?

Answer 1

This looks okay to me for now.

As you are passing arguments to the script, remember that you need to not pass the arguments directly into the executed statements, at least not if you not desire the monitoring machine/user to have an actual shell on the system.