Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to provide a SOCKS proxy with my SSH server but not enable shell access. I have created a user and changed its shell to /usr/bin/nologin, but this means when I SSH into it PuTTY immediately closes... is there any way to maintain the session so I can make use of the SOCKS tunnel?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If using only public key authentication is acceptable, then one method would be to add a designated public key entry to your authorized_keys file that uses the command option to limit what can be done. For example:

command="sleep 100000000",no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAA...

With this configuration in place, whenever you log in with this particular public key, sshd will automatically run the command sleep 100000000 (essentially waiting indefinitely), but will disallow running any other commands. However, you should still be able to use the SOCKS proxy functionality. For more details about the command option, refer to the sshd(8) manpage.

share|improve this answer
    
I understand this is a potential solution, but how could I provide a proxy with password authentication as well? Distributing the key is not as easy as a user/pass combination which can be easily communicated on a whim in person. –  deed02392 Dec 17 '12 at 22:22
    
If you really want to do it that way, you should be able to define your own "nologin"-type shell that simply sleeps for a long time. That is, just define a shell script that calls sleep 100000000 as above, and save it as /usr/local/bin/nologin, or whatever you like. Also, make sure to add it to /etc/shells. –  jjlin Dec 17 '12 at 23:51
    
That sounds like a good solution. Now when I meet associates I can just simply share the password instead of arranging to exchange the key. –  deed02392 Dec 19 '12 at 8:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.