Contents
A command restriction for the user prevents the backup server from being automatically compromised if the private key is compromised. Since the user is restricted to a command in the authorized_keys file, he must not execute any other command or set up a terminal session via SSH.
What happens if your SSH key is compromised?
When you configure SSH for public key authentication, private keys then enable access to accounts. If a private key gets compromised, an attacker can authenticate into the account (s) where the private key is trusted.
Are there any backdoors in the SSH protocol?
Backdoor Keys: By default, most SSH implementations (e.g., OpenSSH) allow users to configure their own authorized key files (placing a public key in an account so they can access it using a private key).
Can a restricted shell be run on SSH?
A major problem with restricted shell is that to secure it, you must use .profile or .bashrc to restrict the PATH, disable builtins, etc., but those files are only invoked for interactive shells. If a user uses ssh to run a remote command they are not invoked.
Is there a way to limit SSH to one command?
In order to limit the user to a single command, the parameter command = is entered before the key. Thereafter, when attempting to set up an SSH connection, only this command is always executed, even if, for example, another command was transferred.
Which is the server side of the SSH key?
The server side is the file authozired_keys in .ssh a user’s primary folder to configure a public-key authentication . Normally, a user gets full access to the system where the authentication was set up. However, in some cases, such as automated backup operations, it makes sense to restrict access to a few or even a single command .
At the backup destination server, this user’s public key is placed in the authorized_keys file so that it can connect without entering a password. Actually, from this point on, the user would have full access to the backup server, even though he always calls only the command rsync .
How to set up public key authentication using SSH?
Set up public-key authentication using SSH on a Linux or macOS computer. To set up public-key authentication using SSH on a Linux or macOS computer: Log into the computer you’ll use to access the remote host, and then use command-line SSH to generate a key pair using the RSA algorithm.
Why is Ctrl-C not allowed in a restricted shell?
It will not return to a shell prompt if it receives an interrupt such as the one generated by Ctrl-C when processing the shell startup files such as /etc/environment and .profile. It should be noted that the restrictions listed above are not enough by themselves to limit access to commands by a user.