1

I have an interactive program. Actually, the program can be reachable over SSH. In the .profile file, the program is launched immediately and with the interactive interface it is not possible to launch any Linux command. However, it is trivial to get a command interpreter with SSH. So, I am wondering what the best practice to prevent the user from sending Linux command.

EDIT: If I used the following Python script:

#! /usr/bin/python3
# -*- coding: utf-8 -*-

from pwn import *
import time

s =  ssh(host='myip', user='myuser', password='mypassword')

sh = s.run('ksh')

The command ksh will be ignored with Forcecommand?

2

You can do this using the ForceCommand option in sshd_config:

ForceCommand

Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block.

You can specify a Match block that is specific to the user or group you're trying to control.

2
  • If i use a script to connect to the SSH and send a command through tue program, the command will be ignored too? I will update my question.
    – salt
    Mar 12 at 18:17
  • Yes, that would be an example of the "command supplied by the client"
    – gowenfawr
    Mar 12 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.