Shell – Passwordless SSH for “System User” with NO Login Shell

Securityshellssh

I have learned a lot today messing around with ssh with RSA and creating system user accounts with no password, no login etc etc. What I was trying to do was create a user with a home directory needed for ~/.ssh/ and a password (needed for initial ssh setup)

But I can't seem to get it set-up correctly.

I know about using 

ssh-keygen
ssh-copy-id user@remotehost

This is simple for RSA

and I know how to create a user with say

useradd -r newuser

OR

adduser newuser --system --shell=/bin/false
passwd newuser
passwd -d newuser

  • The End Goal

    is a user who doesn't have a shell, or atleast can't be logged into from a remote computer, but can still be used to ssh over to another computer and run a command. Is this even possible?

  • The REASON/GOAL

    is to have a user whom when the ups runs low on power, shuts down the other connected computers via ssh before shutting down the main computer. (Only one computer can connect to the UPS via USB at a time to monitor the stats).

I don't want people to be able to log in via SSH with the username UPS, but I need ups to be able to ssh into remotehost without password.

Best Answer

Set the crypt field to * or to !! in /etc/shadow

eg

# adduser tst  
# passwd -l tst
Locking password for user tst.
passwd: Success
# grep tst /etc/passwd
tst:x:1000:1000::/home/tst:/bin/bash
# grep tst /etc/shadow
tst:!!:17030:0:99999:7:::

At this point the user can not login because there's no valid password.

Now add a command="/thing/to/do" to the beginning of the public key in the authorized_keys file

eg

# ls -l $PWD/authorized_keys 
-rw-r--r-- 1 tst tst 431 Aug 17 17:54 /home/tst/.ssh/authorized_keys

# cat $PWD/authorized_keys
command="/bin/echo hello" ssh-rsa AAAAB3NzaC1yc2E....etcetc

Now this key can be used, but the only thing it can be used for is that forced command:

$ ssh -i ~/.ssh/id_rsa tst@test1
hello
Connection to test1 closed.

If you try to do anything else it'll fail, and still force the same command

$ ssh -i ~/.ssh/id_rsa tst@test1 reboot 
hello
$
Related Question