RESTRICTED-SSH-COMMANDS(1)

📦
version 0.4 · 2 versions
, in debian bookworm, ubuntu jammy, ubuntu noble

💖 restricted-ssh-commands — the manual page, bestie edition 💖

okay so. this is the restricted-ssh-commands manual page, from section 1 of the manual (that's the "user commands" section, iykyk). it's a lil program that lets you hand someone SSH access but only for a specific lil list of commands. very "you can come to the party but you're not touching the aux" energy. let's get into it 🫶

✨ NAME ✨

restricted-ssh-commands — restrict SSH users to a predefined set of commands. that's it, that's the whole vibe. gatekeeping but make it secure 💅

✨ SYNOPSIS ✨

/usr/lib/restricted-ssh-commands [config]

like. one binary, one optional argument. so simple. so clean. we love a minimal interface 🌸

✨ DESCRIPTION ✨

okay so the tea: restricted-ssh-commands is meant to be called by SSH itself, to lock a user down so they can only run specific commands. not "ssh in and do whatever", no no. only the approved list 💅

how does it know what's approved? you put a list of allowed regular expressions in /etc/restricted-ssh-commands/. the command the user is trying to run has to match at least one of those regular expressions. if it doesn't match even one? rejected. blocked. not today. 🚫

this thing is genuinely useful when you wanna grant restricted SSH access so someone can do only certain tasks. for example — and this is a real one — it could let a user upload Debian packages via scp and run reprepro processincoming. like, they get to do the one job and nothing else. main character energy but make it scoped 🔥

now, the optional config parameter? that's the name of the configuration inside /etc/restricted-ssh-commands/ that should be used. and if you just... don't pass config? then the user name gets used instead. convenient ✨

✨ USAGE ✨

step one bestie: create a configuration file at /etc/restricted-ssh-commands/$config 🎀

step two: add the following line to ~/.ssh/authorized_keys so it actually gets used:

command="/usr/lib/restricted-ssh-commands",no-port-forwarding,\
no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa [...]

and that's the whole setup. slay. 💖

oh and — if you want debug output (and honestly who doesn't love seeing what's happening), set the RSC_VERBOSE environment variable to a nonzero value. easiest way is to just add it right there in authorized_keys:

command="RSC_VERBOSE=1 /usr/lib/restricted-ssh-commands"

boom. verbose mode. you're welcome 🦋

✨ EXIT STATUS ✨

here's the part you actually need to know, no skimming 👑

if the command is allowed and therefore executed, restricted-ssh-commands will exit with the exit status from the called command. so like, it passes the receipts straight through. 💯

if the command is rejected, restricted-ssh-commands will exit with one of these:

  • 124 — a configuration file was found and it contains at least one regular expression, but the requested command does not match any of those regular expressions. so the rules exist, your command just isn't on the list. 😭
  • 125 — the configuration file is missing or does not contain any regular expressions. thus all commands are rejected. yeah. no rules means no entry. it's giving "if you don't have a guest list, nobody's coming in" 💀

✨ EXAMPLES ✨

picture this: you have a Debian package repository on a host using reprepro, and you want to allow package uploads to it. let's go 🎀

so, assuming the user is reprepro and the package configuration is stored in /srv/reprepro, you would create the configuration file /etc/restricted-ssh-commands/reprepro containing these three regular expressions:

^scp -p( -d)? -t( --)? /srv/reprepro/incoming(/[-a-z0-9+~_.]*[-a-z0-9+~_])?$
^chmod 0644( /srv/reprepro/incoming/[-a-z0-9+~_.]*[-a-z0-9+~_])+$
^reprepro ( -V)? -b /srv/reprepro processincoming foobar$

three lines. that's the whole allowlist. and it works. obsessed 🫶

🚨 SECURITY NOTES 🚨

okay bestie, sit down, this is the serious one. do NOT — like, genuinely, it is dangerous and not recommended — to use negative bracket expressions (things like [^ /]). 😭

why? because characters like CR, LF, $, &, ;, (, ) and so on can be abused to execute arbitrary commands. that's not a maybe, that's a can be. 🙈

for example, this rule right here:

^echo [^ /]$

can be abused to execute these commands:

echo foo&echo owned
echo foo&rm -rf $(printf "\x2f")

and before you ask — yes, a TAB is used instead of spaces after the first ampersand. sneaky. 💀

so, the takeaway, the moral of the story, the whole point: only use positive bracket expressions (like [a-z]). periodt. 💅

fr fr, this one is not a drill. negative bracket expressions = bad news. positive only.

✨ FILES ✨

the configuration files live in /etc/restricted-ssh-commands/. 🌸

rules of the road, one per line:

  • each line in the configuration file represents one POSIX extended regular expression (ERE)
  • lines starting with # are considered comments and are ignored 🎀
  • empty lines (containing only whitespaces) are ignored too

that's it. clean, simple, no drama ✨

✨ SEE ALSO ✨

go read them, they're actually good, i promise 📚

✨ AUTHOR ✨

restricted-ssh-commands and this manpage have been written by Benjamin Drung <benjamin.drung@profitbricks.com>. thank you for your service, king 👑💖

okay that's the whole page!! restricted-ssh-commands, version dated 2017-09-29, manual page for RESTRICTED-SSH-COMMANDS section 1 — mwah, that's the sign-off bestie, go lock down those SSH users responsibly 🎀✨🫶

📦 where this page comes from