sshdo

configurable control for ssh authorized_keys forced commands


What is sshdo? | Supported Platforms | Documentation | Download

What is sshdo?

sshdo provides an easily configurable way of controlling which commands may be executed via incoming ssh connections.

An ssh public key in a ~/.ssh/authorized_keys file can have a command="" option which forces a particular command to be executed when the key is used to authenticate an ssh connection. This is a security control that mitigates against private key compromise.

This is great when you only need to execute a single command. But if you need to perform multiple tasks, you would normally need to create and install a separate key pair for each command, or just not bother making use of forced commands and allow the key to be used to execute any command.

Instead, you can make sshdo act as the forced command, and when an ssh connection tries to execute a command, sshdo will consult the configuration files, /etc/sshdoers and /etc/sshdoers.d/*, to decide whether or not the user and key are allowed to execute the command. The requested command is only executed if it is allowed by the configuration.

This makes it possible to use a single authorized key for any number of commands and still prevent its use for any other purpose.

You will need to identify the commands that need to be allowed by each user and authorized key. To make this easy, sshdo can be put into training mode where it will allow all commands to execute and log them.

After some time, sshdo can then learn from the logs and create the configuration necessary to allow the commands that were encountered during training mode.

It can also unlearn occasionally and create a new configuration that will no longer allow commands that no longer appear to be in use. This can help to maintain strict least privilege.

sshdo is freely available under the GNU General Public License.

Supported Platforms

sshdo is written in Python2 and should run on most systems. It assumes POSIX and an sshd server and a syslog-compatible logging ssystem.

Documentation

There is a README file and two manual pages:

README.md - Description, Requirements, Install, Copying, History
sshdo(8) - configurable control for ssh authorized_keys forced commands
sshdoers(5) - configuration file for sshdo(8)

Download

Latest: sshdo-0.1.tar.gz (SHA256 9b81ea634bb310f2ed0244fa9eeac09dec33b89caab460409c099ed312254129)

What is sshdo? | Supported Platforms | Documentation | Download

Last modified by raf at Thu 13 Dec 2018 08:08:08 AEDT
v v