We have a service that manages files both over a webinterface but also requires access to files via rsync. One way to handle this is to give each user a UNIX account on the system and allow only access if the program run over ssh is the receiving end of rsync as these users should not be able to use the server as a remote computing device.
Managing keys via a webinterface was easy enough by using the AuthorizedKeyProgram directive in the sshd config but I wonder how one would set up a system where there is only ONE login, like github has a single "github" user for their ssh git connection and then change the underlying directory the connection has access to based on what ssh key was used to open the connection.
How can I combine the AuthorizedKeyProgram of sshd with other programs like an ssh command and other restricting systems to make a one login multiple users ssh login as github seems to use for their repositories and the "git" program?
Right now the AuthorizedKeyProgram reads out the ssh keys from a database and then appends a "only-rsync.sh" script as a forced command:
print("command=\"only_rsync\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty" + key) The "only-rsync.sh" script simply does the following:
#!/bin/bash if [ -n "$SSH_ORIGINAL_COMMAND" ]; then if [[ "$SSH_ORIGINAL_COMMAND" =~ ^rsync\ ]]; then exec $SSH_ORIGINAL_COMMAND --chmod=a+rwX fi fi 