Unix – Allow user to set up an SSH tunnel, but nothing else

sshunix

I'd like to allow a user to set up an SSH tunnel to a particular machine on a particular port (say, 5000), but I want to restrict this user as much as possible. (Authentication will be with public/private keypair).

I know I need to edit the relevant ~/.ssh/authorized_keys file, but I'm not sure exactly what content to put in there (other than the public key).

Best Solution

On Ubuntu 11.10, I found I could block ssh commands, sent with and without -T, and block scp copying, while allowing port forwarding to go through.

Specifically I have a redis-server on "somehost" bound to localhost:6379 that I wish to share securely via ssh tunnels to other hosts that have a keyfile and will ssh in with:

$ ssh -i keyfile.rsa -T -N -L 16379:localhost:6379 someuser@somehost

This will cause the redis-server, "localhost" port 6379 on "somehost" to appear locally on the host executing the ssh command, remapped to "localhost" port 16379.

On the remote "somehost" Here is what I used for authorized_keys:

cat .ssh/authorized_keys   (portions redacted)

no-pty,no-X11-forwarding,permitopen="localhost:6379",command="/bin/echo do-not-send-commands" ssh-rsa rsa-public-key-code-goes-here keyuser@keyhost

The no-pty trips up most ssh attempts that want to open a terminal.

The permitopen explains what ports are allowed to be forwarded, in this case port 6379 the redis-server port I wanted to forward.

The command="/bin/echo do-not-send-commands" echoes back "do-not-send-commands" if someone or something does manage to send commands to the host via ssh -T or otherwise.

From a recent Ubuntu man sshd, authorized_keys / command is described as follows:

command="command" Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored.

Attempts to use scp secure file copying will also fail with an echo of "do-not-send-commands" I've found sftp also fails with this configuration.

I think the restricted shell suggestion, made in some previous answers, is also a good idea. Also, I would agree that everything detailed here could be determined from reading "man sshd" and searching therein for "authorized_keys"

Related Question