Restrict ssh-key to rsync only

Friends,

In this blog I am sharing how to restrict your ssh-key. Just take an example for below ssh key

example 1)

from="192.168.101.221",command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa .... 

Details are below,
from= Restrict from specific host
command=Specifies that the command is executed whenever this key is used for authentication
no-port-forwarding= Forbids TCP forwarding
no-agent-forwarding=Forbids authentication agent forwarding
no-X11-forwarding=Forbids X11 forwarding

So basically this key can use for having scp-only access from particular host.

example 2 )
command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/home/user/data/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa ....

Above  will restrict user to scp only for /home/user/data/ folder

Example 3) Now take a example to allow only rsync.

cat /home/$USERNAME/rsync-check.sh

#!/bin/sh
case "$SSH_ORIGINAL_COMMAND" in 
*\&*) 
echo "Rejected" 
;; 
*\(*) 
echo "Rejected" 
;; 
*\{*) 
echo "Rejected" 
;; 
*\;*) 
echo "Rejected" 
;; 
*\<*) 
echo "Rejected" 
;; 
*\>*) 
echo "Rejected" 
;; 
*\`*) 
echo "Rejected" 
;; 
*\|*) 
echo "Rejected" 
;; 
rsync\ --server*) 
$SSH_ORIGINAL_COMMAND 
;; 
*) 
echo "Rejected" 
;; 
esac

Now change your authorized_keys file as below

command="/home/$USERNAME/rsync-check.sh" ssh-rsa....

example 4) Just take an example of authorized_keys file for aws server.

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ubuntu\" rather than the user \"root\".';echo;sleep 10" ssh-rsa ...

Now you can understand how we were getting warning to use right user name error while connecting aws boxes.

Note: Just check man page of sshd and make your own use case.