How to create a ssh key so that it can only use sshfs on a Synology NAS?

Question

I have an ssh key without a paraphrase that allows a user to log in to a remote server.

This key is used to mount a folder in the remote server using sshfs and backup the files in my laptop.

I would like this key to have sufficient privileges to the backup only. So, since sshfs uses sftp, I thought putting:

command="path to sftp in the server"

in the server's authorized_keys file would work.

Now, when I log in via ssh, I get this:

usage: sftp [-1246Cpqrv] [-B buffer_size] [-b batchfile] [-c cipher]

   [-D sftp_server_path] [-F ssh_config] [-i identity_file] [-l limit]
   [-o ssh_option] [-P port] [-R num_requests] [-S program]
   [-s subsystem | sftp_server] host

   sftp [user@]host[:file ...]
   sftp [user@]host[:dir[/]]
   sftp -b batchfile [user@]host

Connection to "my server's name" closed.

I take this to mean that this key can only use sftp, which is what I wanted.

However, when I use sshfs, I get the following:

remote host has disconnected

The server is a Synology NAS DS212j with DSM 4.2 and there is no sftp-server program. The following is what the subsystem section looks like in the sshd_config file:

# override default of no subsystems
#Subsystem sftp /usr/libexec/sftp-server
#Subsystem sftp internal-sftp -f DAEMON -l VERBOSE -u 000

Subsystem sftp internal-sftp -f DAEMON -u 000
#Subsystem sftp /usr/syno/sbin/sftp-server -l DEBUG3

sshfs using a key without any restrictions on the commands works fine.

Please advise. Are there more commands I should include in the "command" variable in the authorized_keys file?

Thank you in advance for any help provided.

Answer 1

I don't know for sshfs which command you must authorize but if you want add many command authorized for a specific key you can use a bash script to perform the authorization:

command="/home/user/validate-rsync.sh" ssh-dss AAAAB3NzaC1yc

/home/user/validate-rsync.sh:

#!/bin/sh
case "$SSH_ORIGINAL_COMMAND" in
*\&*)
echo "Rejected"
;;
*\;*)
echo "Rejected"
;;
rsync\ --server*)
$SSH_ORIGINAL_COMMAND
;;
*)
echo "Rejected"
;;
esac

make sure the script validate-rsync.sh is executable. I hope it can help you.