Helper for validating commands executed over SSH (via .authorized-keys / SSH_ORIGINAL_COMMAND)

ssh-policy

#!/bin/bash -e
# ssh-policy: Helper for validating and running SSH_ORIGINAL_COMMAND
# Patterns are matched via grep -x -z [-F/-B/-E]

function fail() {
  echo "$1" >&1
  exit 100
}

[ $# == 1 ] || fail "command syntax error, denied"

policy="$HOME/.ssh/policy/$1"
[ -r "$policy" ] || fail "no policy available, denied"

cmd="$SSH_ORIGINAL_COMMAND"
[ -n "$cmd" ] || fail "no command specified, denied"

allow=
ln=0
while read -r line; do
  let ++ln
  [ -n "$line" ] || continue
  [[ "$line" != \#* ]] || continue

  type="${line%% *}"
  pattern="${line#* }"
  if [ "$type" = "-F" -o "$type" = "-B" -o "$type" = "-E" ]; then
    if echo -n "$cmd" | grep -q -x -z "$type" "$pattern"; then
      allow=true
    fi
  else
    fail "invalid policy (line $ln), denied"
  fi
done < "$policy"
[ -n "$allow" ] || fail "denied by policy"

exec "$SHELL" -c "$cmd"