Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a requirement where I want that user of my C++ program is able to do passwordless ssh on to a particular machine but the same user should not be able to do ssh on the same machine through a normal terminal/shell.

share|improve this question

On a Unix system you should make the program's executable setuid to that it can run ssh -i against an identity file otherwise inaccessible to a user running the program. That identity file would authenticate access to a remote machine.

share|improve this answer
    
I could not understand your answer fully, executable needs to do setuid to which uid? – Saurabh Jan 14 '13 at 8:27
    
@Saurabh setuid to a user you set up specifically to allow remote access to the particular machine in question. – Kyle Jones Jan 14 '13 at 8:29
    
No that is not an option, as I need to do ssh on to remote machine through my program only through that user's id. – Saurabh Jan 14 '13 at 8:31
    
@Saurabh What does your ssh care what user it is running as, as long as you use the right username@remotemachine? – Christian Jan 14 '13 at 10:43

You could hard code the SSH private key into programs source (or use a key chain - cleaner, easier to maintain), and then append the associated public key to the remote hosts authorized_keys file.

share|improve this answer

Use private key authentication and disable other authentication methods on the server.

Additionally you may use the ForceCommand directive in the sshd_config of the server to only allow the given command to run.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .