During the research for my
ssh gateway project, I came across the issue, that I didn't want the ssh users to execute any commands on the gateway itself. They would still need the ability to login, since I needed the ssh connection for tunneling traffic into the private network. Discussions with a friend of mine, brought us to the idea, to replace the standard shell with something else, that stays alive, as long as the user doesn't type something specific. Afterwards it would just terminate and the ssh session will be closed.
Please welcome the "All You Can Do Is Exit" Shell.
A little bit of python did the job for me. Obviously this is depending on python being installed on your computer and there are various other ways to do this.
# cat /aycdiesh
#! /usr/local/bin/python2.4
while True:
try:
x = ""
while x !="exit":
x = raw_input("Type 'exit': ");
if x != "exit":
print "Only 'exit' is allowed !!";
break;
except KeyboardInterrupt:
break;
Assigning the aycdiesh as a shell to the user "test", will lead to the required results.
# userinfo test
login test
passwd *
uid 1003
groups test
change NEVER
class
gecos test
dir /home/test
shell /aycdiesh
expire NEVER
Testing the login:
>ssh -l test ssh_gateway
test@ssh_gateway's password:
Last login: Wed Feb 7 11:16:40 2007 from 10.169.20.58
OpenBSD 4.0 (GENERIC) #625: Sun Sep 17 23:46:46 MDT 2006
Welcome to the ssh access gateway.
Type 'exit': dsr08tg245t243
only 'exit' is allowed !!
Type 'exit': exit
OK
Connection to ssh_gateway closed.
>
As always, I welcome comments to this entry, since I don't think I am a genius. Let me know, if something is wrong, or if you come up with different approaches or a better solution at all.