I have a requirement where I want that user of my C++ program is able to do passwordless ssh on to a particular machine but the same user should not be able to do ssh on the same machine through a normal terminal/shell.
Add a comment
|
3 Answers
On a Unix system you should make the program's executable setuid to that it can run ssh -i against an identity file otherwise inaccessible to a user running the program. That identity file would authenticate access to a remote machine.
answered Jan 14, 2013 at 7:55
-
I could not understand your answer fully, executable needs to do setuid to which uid?– SaurabhJan 14, 2013 at 8:27
-
@Saurabh setuid to a user you set up specifically to allow remote access to the particular machine in question. Jan 14, 2013 at 8:29
-
No that is not an option, as I need to do ssh on to remote machine through my program only through that user's id.– SaurabhJan 14, 2013 at 8:31
-
@Saurabh What does your ssh care what user it is running as, as long as you use the right username@remotemachine? Jan 14, 2013 at 10:43
You could hard code the SSH private key into programs source (or use a key chain - cleaner, easier to maintain), and then append the associated public key to the remote hosts authorized_keys file.
Use private key authentication and disable other authentication methods on the server.
Additionally you may use the ForceCommand directive in the sshd_config of the server to only allow the given command to run.
