SSHD configuration for root: "forced-commands-only"

[Dave Hammond]

System: SuSE version 9

I'm trying to configure SSHD to allow root login only for remote
commands. According to the description of PermitRootLogin in the
sshd_config man page:

"If this option is set to ``forced-commands-only'' root login with
public key authentication will be allowed, but only if the command
option has been specified".

Currently, SSHD is configured for root equivalence between the two
servers (id_dsa, id_dsa.pub, and known_hosts2 are identical), so that
if PermitRootLogin is yes, no password is required. If I issue the
command:

# ssh ***@host "date"

the date command runs immediately. However, after I change the value to
"forced-commands-only", the remote server requires a password when I
issue the same command. Clearly, the identical set of id_dsa* and
known_hosts2 files does not satisfy the required public key
authentication.

Any advice or pointers on how to accomplish the required public key
authentication would be greatly appreciated. Thanks!

-Dave H.

[JohnK]

Post by Dave Hammond
the date command runs immediately. However, after I change the value to
"forced-commands-only", the remote server requires a password when I
issue the same command. Clearly, the identical set of id_dsa* and
known_hosts2 files does not satisfy the required public key
authentication.
Any advice or pointers on how to accomplish the required public key
authentication would be greatly appreciated. Thanks!

I think you may have misunderstood what forced-commands-only does. You
need to specify what command is to be run in the authorized_keys file.
The authorized_keys file format should look like this -

from="10.1.1.5",command="/usr/bin/ls" <public keydata>

From the (not very detailed) man page
If this option is set to “forced-commands-only” root login with public
key authentication will be allowed, but only if the command option has
been specified (which may be useful for taking remote backups even if
root login is normally not allowed). All other authentication methods
are disabled for root.

I assume your machine is prompting for a password because it cannot find
a suitable line with a command in the authorized_keys file.

JohnK

[Dave Hammond]

Post by JohnK
I think you may have misunderstood what forced-commands-only does. You
need to specify what command is to be run in the authorized_keys file.
The authorized_keys file format should look like this -
from="10.1.1.5",command="/usr/bin/ls" <public keydata>

Thanks very much. Indeed, I misunderstood the man page.

-Dave H.