How to send data to local clipboard from a remote SSH session

Question

Borderline ServerFault question, but I\'m programming some shell scripts, so I\'m trying here first :)

Most *nixes have a command that will let you pipe/red

Answer 1

This answer develops both upon the chosen answer by adding more security.

That answer discussed the general form

 | \
    ssh @ 

Where security may be lacking is in the ssh permissions allowing on host B> to ssh into host A and execute any command.

Of course B to A access may already be gated by an ssh key, and it may even have a password. But another layer of security can restrict the scope of allowable commands that B can execute on A, e.g. so that rm -rf / cannot be called. (This is especially important when the ssh key doesn't have a password.)

Fortunately, ssh has a built-in feature called command restriction or forced command. See ssh.com, or this serverfault.com question.

The solution below shows the general form solution along with ssh command restriction enforced.

Example Solution with command restriction added

This security enhanced solution follows the general form - the call from the ssh session on host-B is simply:

cat  | ssh @ to_clipboard

The rest of this shows the setup to get that to work.

Setup of ssh command restriction

Suppose the user account on B is user-B, and B has an ssh key id-clip, that has been created in the usual way (ssh-keygen).

Then in user-A's ssh directory there is a file

/home/user-A/.ssh/authorized_keys

that recognizes the key id-clip and allows ssh connection.

Usually the contents of each line authorized_keys is exactly the public key being authorized, e.g., the contents of id-clip.pub.

However, to enforce command restriction that public key content is prepended (on the same line) by the command to be executed.
In our case:

command="/home/user-A/.ssh/allowed-commands.sh id-clip",no-agent-forwarding,no-port-forwarding,no-user-rc,no-x11-forwarding,no-pty 

The designated command "/home/user-A/.ssh/allowed-commands.sh id-clip", and only that designated command, is executed whenever key id-clip is used initiate an ssh connection to host-A - no matter what command is written the ssh command line.

The command indicates a script file allowed-commands.sh, and the contents of that that script file is

#/bin/bash
#
# You can have only one forced command in ~/.ssh/authorized_keys. Use this
# wrapper to allow several commands.

Id=${1}

case "$SSH_ORIGINAL_COMMAND" in
    "to-clipboard")
          notify-send "ssh to-clipboard, from ${Id}"
        cat | xsel --display :0 -i -b
          ;;
    *)
        echo "Access denied"
        exit 1
        ;;
esac

The original call to ssh on machine B was

... | ssh @ to_clipboard

The string to-clipboard is passed to allowed-commands.sh by the environment variable SSH_ORIGINAL_COMMAND. Addition, we have passed the name of the key, id-clip, from the line in authorized_keyswhich is only accessed by id-clip.

The line

          notify-send "ssh to-clipboard, from ${Id}"

is just a popup messagebox to let you know the clipboard is being written - that's probably a good security feature too. (notify-send works on Ubuntu 18.04, maybe not others).

In the line

cat | xsel --display :0 -i -b

the parameter --display :0 is necessary because the process doesn't have it's own X display with a clipboard, so it must be specificied explicitly. This value :0 happens to work on Ubuntu 18.04 with Wayland window server. On other setups it might not work. For a standard X server this answer might help.

host-A /etc/ssh/sshd_config parameters

Finally a few parameters in /etc/ssh/sshd_config on host A that should be set to ensure permission to connect, and permission to use ssh-key only without password:

PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
AllowUsers user-A

To make the sshd server re-read the config

sudo systemctl restart sshd.service

or

sudo service sshd.service restart

conclusion

It's some effort to set it up, but other functions besides to-clipboard can be constructed in parallel the same framework.