LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 01-29-2024, 08:12 AM   #1
ario
Member
 
Registered: Nov 2010
Posts: 65

Rep: Reputation: 2
ssh authorized_keys command= does not work


Hi Folks,
On the internet there are numerous articles and forums topics talking about adding a line like:
Code:
command="/usr/bin/ls" <ssh-key-here>
To the file:
Code:
$HOME/.ssh/authorized_keys
And it will supposedly limit the command that the user can run.
Well it didn't!
So I can ssh from my client to the server when my authorized_keys file is like:
Code:
<ssh-key-here>
And cannot login when it is like:
Code:
command="/usr/bin/ls" <ssh-key-here>
The error is:
Code:
server.address.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
Notice that the whole stack of network, operating system, ssh, configuration, keys, permission, etc works properly, UNTIL I add the command= to the beginning of the line. Then it does not work.
Please help. Thanks in advance.
 
Old 01-29-2024, 08:30 AM   #2
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 7,333
Blog Entries: 3

Rep: Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730Reputation: 3730
Something is obviously wrong with how you are prepending the command="..." part. For example, you might have copy-pasted smart quotes from a tutorial or guide instead of using proper ASCII quotes.

But it is hard to guess without more information. Do you have access to the server such that you can read the logs made by sshd? Or, better yet, can you temporarily run a more verbose instance and capture the results to a file as you try connecting with the defective authorized_keys file? e.g.

Code:
/usr/sbin/sshd -p 2022 -d -d -E /tmp/ssh.log
Then connect to the server on port 2022 instead of port 22 as you get the error. Then check the file /tmp/ssh.log on the server for clues. It should say something about error.
 
Old 01-29-2024, 09:25 AM   #3
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,760

Rep: Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931Reputation: 5931
How did you edit the file? Are the authorized_keys file permissions still -rw------ and owned by your user?
 
Old 01-29-2024, 02:25 PM   #4
ario
Member
 
Registered: Nov 2010
Posts: 65

Original Poster
Rep: Reputation: 2
Quote:
Originally Posted by michaelk View Post
How did you edit the file? Are the authorized_keys file permissions still -rw------ and owned by your user?
Thanks for the reply.
The file permissions are correct. Because when I remove the command= part from the beginning, everything works. So any other ideas?
 
Old 01-29-2024, 02:36 PM   #5
ario
Member
 
Registered: Nov 2010
Posts: 65

Original Poster
Rep: Reputation: 2
Quote:
Originally Posted by Turbocapitalist View Post
Something is obviously wrong with how you are prepending the command="..." part. For example, you might have copy-pasted smart quotes from a tutorial or guide instead of using proper ASCII quotes.

But it is hard to guess without more information. Do you have access to the server such that you can read the logs made by sshd? Or, better yet, can you temporarily run a more verbose instance and capture the results to a file as you try connecting with the defective authorized_keys file? e.g.

Code:
/usr/sbin/sshd -p 2022 -d -d -E /tmp/ssh.log
Then connect to the server on port 2022 instead of port 22 as you get the error. Then check the file /tmp/ssh.log on the server for clues. It should say something about error.
Thanks man. Now I can see some logs:
Code:
Bad options in /home/ec2-user/.ssh/authorized_keys file, line 3: command=ls
So seeing that log output, below combination finally worked:
Code:
command="/usr/bin/echo 'No commands allowed'" <ssh key here>
Thanks for all replies.
 
  


Reply

Tags
authorized_keys, security, ssh



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
SELinux preventing ssh login with ~/.ssh/authorized_keys Seattle98122 Linux - Security 3 04-14-2017 05:15 AM
[SOLVED] Difference between .ssh/known_hosts and .ssh/authorized_keys shivaa Linux - Newbie 7 10-30-2012 12:54 PM
Can't get authorized_keys command="..." to work (SSH) KenJackson Linux - Software 2 07-09-2011 11:20 AM
using root with ssh 'command=' and authorized_keys hank43 Linux - Security 1 09-11-2006 05:51 AM
ssh users and authorized_keys ifm Linux - Security 3 06-12-2002 08:24 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 02:32 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration