authorized_keys forced command with ssh and a wrapper-script like this:
#!/usr/bin/env bash case "$SSH_ORIGINAL_COMMAND" in /var/lib/authorized-scripts/*) $SSH_ORIGINAL_COMMAND ;; *) exit 1 ;; esac
Can a malicious user somehow chain another command after
/usr/bin/authorized-scripts/ and therefore overcome this security measure or is this secure?
This suggests that I could simply use
ssh user@host '/var/lib/authorized-scripts/script.sh && cat /etc/passwd', but this did not work in my tests.
Can I somehow improve the security of this script while still allowing multiple commands with user-supplied arguments for a single ssh key?
I am aware that the allowed commands themselves should ofcourse not allow any kind of subshells (so,
find for example is a nogo for example due to its