Mdthbs

I have the following setup where I use an OpenSSH server to remotely start a certain command using ssh.

My authorized_keys file has the following entry:

command="/path/to/script.sh $SSH_ORIGINAL_COMMAND",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ssh-rsa AAAA…qGDf my_special_key

This means that if anyone connects using that key (e.g. by using ssh -i special_key_file user@server) the script script.sh gets executed on my server. Now there is also the $SSH_ORIGINAL_COMMAND placeholder which gets replaced by all the extra command line to the ssh command, i.e. ssh -i special_key_file user@server foobar means that the $1 will have foobar in it.

To test it I can make my script.sh look the following:

#!/bin/sh

printf '<%s>n' "$@"

Now for ssh -i special_key_file user@server 'foo bar' just like for ssh -i special_key_file user@server foo bar I will get the following same result:

<foo>

<bar>

Because of splitting. And if that wasn't bad enough, for ssh -i special_key_file user@server '*' I'm getting a file list:

<file1>

<file2>

…

So apparently the whole extra command line gets inserted into what is inside command= which is then run in a shell, with all the splitting and globing steps happening. And apparently I can't use " inside the command="…" part so I can't put $SSH_ORIGINAL_COMMAND inside double quotes to prevent that from happening. Is there any other solution for me?

BTW, as explained in this dismissed RFE to introduce a $SSH_ESCAPED_ORIGINAL_COMMAND the ssh protocol is party to blame as all the extra command line is transferred as one string. Still this is no reason to have a shell on the server side do all the splitting, especially if it then also does the glob expansion (I doubt that is ever useful here). Unlike the person who introduced that RFE I don't care about splitting for my use case, I just want no glob expansion.

Could a possible solution have to do with changing the shell environment OpenSSH uses for this task?

Use quotes:

cat bin/script.sh

#!/bin/sh

printf '<%s>n' "$@"

command="/home/user/bin/script.sh "${SSH_ORIGINAL_COMMAND}"" ssh-rsa AA...

ssh -i .ssh/id_rsa.special hamilton '*'

<*>

ssh -i .ssh/id_rsa.special hamilton 'foo bar'

<foo bar>

But also you will get:

ssh -i .ssh/id_rsa.special hamilton '*' 'foo bar'

<* foo bar>

Not sure is it a problem for you or not.

And I was confused about:

And apparently I can't use " inside the command="…"

I thought it's kind of limitation in your task so deleted my answer.

I'm glad my answer helped you with your task!

There should be no need to put $SSH_ORIGINAL_COMMAND on the command line at all. It's available as an environment variable to /path/to/script.sh. That would automatically remove one level of shell-evaluation.

Also, if you don't want your shell to expand any glob characters, consider writing script.sh in some language that isn't a shell such as perl/python/ruby/etc. Non-shell languages will only perform glob/file expansion when explicitly instructed to. But that might not be necessary if it obtains the value of $SSH_ORIGINAL_COMMAND directly from the environment rather than having it passed to it via the command line.