Home

Search this site:
 

Horshack’s
very
own site

 

This is Bavaria, Germany!
You will find links to Perl,
bootdisks for system administration,
a lot of Linux,
Windows administration
and some personal belongings.
ssh for admins, restricting users, allowing users to do special things

ssh for admins, restricting users, allowing users to do special things


Get fingerprint of sshd

You can get the fingerprint of your sshd as a usual user:
$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub 
1024 88:b8:5e:46:27:34:a3:e4:9d:ca:62:e0:a7:96:e6:05 /etc/ssh/ssh_host_rsa_key.pub

$ ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key.pub
1024 1a:73:11:b8:a6:f4:5a:b7:9e:70:f3:f6:fa:73:c5:13 /etc/ssh/ssh_host_dsa_key.pub

Get fingerprints from your known_hosts file

$ ssh-keygen -l -f ~/.ssh/known_hosts
1024 a8:ae:17:82:16:54:6e:e6:51:3a:99:d0:b5:10:fa:15 shell.franken.de
1024 64:47:34:ac:3e:e9:82:f2:76:4b:a4:2b:32:95:88:55 fugu.zirndorf.de

How to restrict a user only to portforwarding
special ports to special hosts

This sounds strange, what? Ok, let me tell you for what you would need that...

I have a user which works with my MySQL-database by Windows-ODBC. The usual communication between client and server runs unencrypted. So I decided to tunnel the communication through an ssh-tunnel.

Create a file ~user/.ssh/authorized_keys like this

#  -> command="..."
#     this command simply prints something to prevent a timeout while
#     the ssh-session is running. quoting-character like double quotes
#     in this command must be quoted with backslash
#  -> permitopen="127.0.0.1:3306"
#     restrict the person using this key to only portforwarding 
#     3306 to localhost
#  -> from=...
#     only allow connections from this host (not needed but sometimes useful)
# the rest is the public key
command="/usr/bin/perl -e '$|=1;while (1) { print scalar localtime() . \"\n\";sleep 30}'", 
permitopen="127.0.0.1:3308",
from="farside.zirndorf.de" 
ssh-dss AAAAB3NzaC1kc3MAAACBAJ4vXg== some@comment_for_key

All these lines (command, permitopen, ...) must be in one line.

Doing something as root on the other machine

I have to copy some files with rsync to a local machine. But, because to preserve the rights of the files I have to be root on the remote machine.

The local command is this:
root# /usr/bin/rsync \\
--archive --progress -v \\
--exclude '/var/log/*.gz' \\
-e 'ssh -i /path/to/ssh_idfile_for_this_action' --rsync-path="sudo /usr/bin/rsync" \\
--delete \\
--compress \\
simpleguy@somewhere.com:/data/to/get/ /local/path/to/save_to/
You must be allowed to do a sudo /usr/bin/rsync on the other machine. You can restrict sudo more with visudo on the other machine.

Restrict login to public key only (no passwords)

This permits logins with a password you type into your keyboard. Change your /etc/ssh/sshd_config like this:

...
RSAAuthentication yes
PubkeyAuthentication yes
# No passwords allowed, only private/public key!
ChallengeResponseAuthentication no
PasswordAuthentication no
...
AllowUsers user1 user2 user3
Impressum