NAME

ssh-auth-cmd-marionette - ssh ~/.ssh/authorized_keys command for Firefox::Marionette

VERSION

Version 1.17

USAGE

~/.ssh/authorized_keys entry to allow the remote user to run a default firefox as user@server (all syslog entries go to LOG_LOCAL0)

   no-agent-forwarding,no-pty,no-X11-forwarding,permitopen="127.0.0.1:*",command="/usr/local/bin/ssh-auth-cmd-marionette" ssh-rsa AAAA ... == user@server

~/.ssh/authorized_keys entry to allow the remote user to run a default firefox as user@server (all syslog entries go to LOG_LOCAL1)

   no-agent-forwarding,no-pty,no-X11-forwarding,permitopen="127.0.0.1:*",command="/usr/local/bin/ssh-auth-cmd-marionette --facility=LOG_LOCAL1" ssh-rsa AAAA ... == user@server

~/.ssh/authorized_keys entry to force the remote user to run /path/to/firefox when logging in as user@server (all syslog entries go to LOG_LOCAL0)

   no-agent-forwarding,no-pty,no-X11-forwarding,permitopen="127.0.0.1:*",command="/usr/local/bin/ssh-auth-cmd-marionette --force-binary=/path/to/firefox" ssh-rsa AAAA ... == user@server

~/.ssh/authorized_keys entry to allow the remote user to run /path/to/firefox or /path/to/waterfox when logging in as user@server (all syslog entries go to LOG_LOCAL0)

   no-agent-forwarding,no-pty,no-X11-forwarding,permitopen="127.0.0.1:*",command="/usr/local/bin/ssh-auth-cmd-marionette --allow-binary=/path/to/firefox --allow-binary=/path/to/waterfox" ssh-rsa AAAA ... == user@server

DESCRIPTION

This program is intended to allow secure remote usage of the perl Firefox::Marionette library via ssh. It allows a list of pre-defined commands that can be permitted via ssh public key authentication.

Be default, it will log all commands that the remote perl library requests to run on this machine to the LOG_LOCAL0 syslog facility. If desired, syslog messages can be sent to a facility of your choosing, using the syslog(3) documentation for a list of allowed facilities and the --facility argument for this program.

An example .ssh/authorized_keys file using this program would look like this

   no-agent-forwarding,no-pty,no-X11-forwarding,permitopen="127.0.0.1:*",command="/usr/local/bin/ssh-auth-cmd-marionette" ssh-rsa AAAA ... == user@server

By default, the only firefox version that may be used will be present in the PATH environment variable. However, the remote user may be permitted to specify the path to a different firefox binary with (multiple) --allow-binary parameters, or simply forced to use the firefox that the local user is setup for with the --force-binary parameter.

REQUIRED ARGUMENTS

None

OPTIONS

Option names can be abbreviated to uniqueness and can be stated with singe or double dashes, and option values can be separated from the option name by a space or '=' (as with Getopt::Long). Option names are also case- sensitive.

--help - This page.
--version - print the version of ssh-auth-cmd-marionette.
--facility - use facility <https://metacpan.org/pod/Sys::Syslog#Facilities> for syslog <https://linux.die.net/man/3/syslog> messages, instead of the default LOG_LOCAL0.
--allow-binary - allow this path to be used in calls to new. This option may be specified multiple times
--force-binary - regardless of the settings that new() requests, send all requests for the firefox binary to the path requested.

CONFIGURATION

ssh-auth-cmd-marionette requires no configuration files or environment variables.

DEPENDENCIES

ssh-auth-cmd-marionette requires the following non-core Perl modules

•: Pod::Simple::Text

DIAGNOSTICS

Check syslog for any errors

INCOMPATIBILITIES

This program depends on exec <https://linux.die.net/man/3/exec> and hence will not work in a Windows environment. Always interested in any ssh incompatibilities. Patches welcome.

EXIT STATUS

This program will either exec <https://linux.die.net/man/3/exec> a permitted program or exit with a 1.

BUGS AND LIMITATIONS

To report a bug, or view the current list of bugs, please visit <https://github.com/david-dick/firefox-marionette/issues>

AUTHOR

David Dick "<ddick@cpan.org>"

LICENSE AND COPYRIGHT

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. See "perlartistic" in perlartistic.

DISCLAIMER OF WARRANTY

BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.