Allow user to set up an SSH tunnel, but nothing else

Question

I'd like to allow a user to set up an SSH tunnel to a particular machine on a particular port (say, 5000), but I don't want to restrict this user as much as possible. (Authentication will be with public/private keypair).

I know I need to edit the relevant ~/.ssh/authorized_keys file, but I'm not sure exactly what content to put in there (other than the public key).

Lorin

Answer 1

See http://www.networknewz.com/networknewz-10-20030707AuthenticatingbyPublicKeyOpenSSH.html

Basically the two main things you need to remember are:

1. Make sure you chmod 700 ~/.ssh
2. Append the public key block to authorized-keys

Answer 2

You will generate a key on the users machine via whatever ssh client they are using. pUTTY for example has a utility to do this exact thing. It will generate both a private and public key.

The contents of the public key file generated will be placed in the authorized_keys file.

Next you need to make sure that the ssh client is configured to use the private key that generated the public key. It's fairly straight forward, but slightly different depending on the client being used.

Answer 3

I'm able to set up the authorized_keys file with the public key to log in. What I'm not sure about is the additional information I need to restrict what that account is allowed to do. For example, I know I can put commands such as:

no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding

I'm not sure if "no-port-forwarding" belongs here, because it's for an SSH tunnel.

I know you can also specify a command:

command=/usr/bin/...

If the SSH is going to be used for tunneling only, and is not to be used for logging into the account, do I need to have the "command" there at all? If so, what should it invoke?

Answer 4

You'll probably want to set the user's shell to the restricted shell. Unset the PATH variable in the user's ~/.bashrc or ~/.bash_profile, and they won't be able to execute any commands. Later on, if you decide you want to allow the user(s) to execute a limited set of commands, like less or tail for instance, then you can copy the allowed commands to a separate directory (such as /home/restricted-commands) and update the PATH to point to that directory.

Answer 5

}} I'm able to set up the authorized_keys file with the public key to log in. What I'm not sure about is the additional information I need to restrict what that account is allowed to do. For example, I know I can put commands such as:

}} no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding

You would want a line in your authorized_keys file that looks like this.

permitopen="host.domain.tld:443",no-pty,no-agent-forwarding,no-X11-forwardi ng,command="/bin/noshell.sh" ssh-rsa AAAAB3NzaC.......wCUw== zoredache