I am trying to restrict an ssh-user to execute unwanted commands using ssh from a remote host a. So for that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command.
If I did not set this, I am able to login via ssh and sftp.
How can I differentiate whether the remote connection is issued via ssh or sftp in a shell script?
The command that I am expecting is as follows and these both should work:-
I used the variable $TERM to differentiate between ssh and sftp. If it is sftp then the $TERM will return 'dumb'. But when we are passing a command through ssh then the $TERM is returning dumb.
Any idea how to differentiate?
My requirement is similar to the 'chroot jail', but not exactly the same.
I have to restrict the ssh-user to execute only one script(wrap_script.sh) and he should not be allowed to login via ssh to a remote server.
eg:-
ssh ssh-user@hostname wrap_scripts.sh
Once this script is executed, the control has to come back to the client system. The client system should be allowed to connect to the remote server using sftp and he should get the sftp prompt.
eg:-
sftp ssh-user@hostname
sftp>
The ssh-user should be only restricted if the connection has come through ssh from a particular client system. Else it should be a normal user.
That is the reason I thought of going for the forced commands in the authorization_keys file in the remote system. So when the connection is coming from that particular client, I should be able to restrict access to that. The ssh-user is a generic user that will be used by other client systems to connect to the remote server. But I need to restrict a particular host as mentioned above.
Thanks in advance. Could anyone please advice?