0

Is it possible to create a user that can log in to one's ssh server and chat, but is restricted from any other activity, i.e. cannot use any significant disk space, cannot access hardware (speakers, microphone, camera), and is perhaps even limited to a low CPU-percentage?

  • 1
    For giving you a proper answer, I need more information. Is that chat some CLI program like ircii, talk etc.? – Garex May 19 '16 at 5:27
  • @Garex, I thought talk or write. – Toothrot May 19 '16 at 11:23
  • ok that is great to know because then you can specify the allowed commands in the authorized_keys directly after the key that is allowed: # authorized_keys command="/usr/bin/talk" <SSH Key> But with that you could also specify a shell script as allowed command you provide some input with it. Please, if you use OpenSSH, have also a look into the AuthorizedKeysCommand in your sshd_config file. – Garex Jun 9 '16 at 8:16
1

If the purpose is only to support a single application which does all of its input via STDIN/STDOUT, you should be able to use the old UNIX trick of specifying that program as the user's shell.

First off, you would need to create a user account for the person; I don't believe you would be able to use the built in "Guest account" since not only do I think it exists only when someone uses the GUI login (read: SSH won't trigger it), but also I don't think there is a concept of default shell for guest.

Second, you need to add the specific program (say /bin/ttychat) to the /etc/shells file. Finally, you need to specify that "shell" as the default for the account you created.

The idea is that when the SSH account logs in, it will redirect all STDIN/STDOUT for the session to the shell you specified. When the program terminates, it should close the connection as well.

I found an unrelated question on Stack Exchange showing how to add custom shells to OSX here.

  • Any idea if it's possible to specify the programme with arguments? if I try I get non-standard shell error msg. – Toothrot May 19 '16 at 19:12
  • I tried using a script containing #!/bin/bash and exec write lawrence, which worked. Can you confirm that there is no way of breaking out of this and gaining access to the shell? – Toothrot May 19 '16 at 19:57
  • @Lawrence, I'm not going to state that it is fool-proof and that you should interpret this mechanism is entirely secure; the script/program you ran as the "shell" needs to be solid and not fail or expose holes. However, I will state that if /bin/ttychat (from example) is the user's shell, exiting that program wouldn't invoke interactive bash but rather close the SSH session. – bjb May 23 '16 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .