On Thu, May 28, 2015 at 05:56:05PM -0700, Rick Stevens wrote: > On 05/28/2015 04:40 PM, Suvayu Ali wrote: > > > >I think the magic incantation for me was command="somecommand" is > >actually the whole command, with all the arguments. From the man page, > >this wasn't clear to me. I was trying to setup passwordless root login > >with PermitRootLogin set to forced-commands-only for backups with > >rsnapshot. > > Ah, yes, you have to put in the whole command and arguments. If you need > spaces to separate arguments, then everything after the '=' has to be > enclosed in quotes: > > command="somecommand -arg1 -arg2 -arg3" > > etc. You can put in multiple options, too: > > command="somecommand -arg1 -arg2 -arg3",from="*.mydomain.com" > > to restrict the user so they'd have to log in from hosts in the > "mydomain.com" DNS domain and the only thing that'd happen if they > did was have "somecommand" run automatically. They'd be disconnected > immediately after "somecommand" completed. I think I played with this successfully. :) > >Btw, to allow multiple commands from the same host, I guess I should > >have multiple lines for the same public key? Also, any ideas what > >should be the command to allow rsnapshot backups? I guess I need to > >figure out what are the arguments passed onto rsync by rsnapshot, and in > >which order. > > AFAIK, you can only have one "command=" per line (or stanza) in the > authorized_keys file for each user. Otherwise, how would the client > specify which to run? Yes, I see that now after reading Gordon's reponse. > You might be able to do some fancy footwork using "Match" clauses in > the /etc/ssh/sshd_config file, but I've never done anything more than > simple matches (match on username or address patterns to put in some > additional restrictions). I'll explore this if I feel I need it, but probably I don't need something that complicated. Thanks again, -- Suvayu Open source is the future. It sets us free. -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
