0

I created a Raspbian-Image which is used by a bunch of friends, colleagues and other nerds. They run it at home on their own Raspberry Pi's. However, I need SSH-Access to that Raspberry Pis to be able to debug problems in their environment. So I decided to set up a Reverse-SSH-Tunnel, that my users can activate to give me temporary access. Currently I'm working with this tutorial: https://linuxhostsupport.com/blog/how-to-setup-reverse-ssh-tunnel-on-linux/

In the first command of the tutorial it says:

ssh -R 24553:localhost:22 user@111.111.111.111

However, this means that I need to set up a new user on the Remote-Ubuntu-Server for the reverse-ssh-tunnel. So I created a new user:

useradd reversessh

Problem is, that my code is fully open-source! Everyone should be able to read and modify it anytime. Everyone has root-access on their own Pi. This is why the password of user "reversessh" will be readable for everyone who got the code/image.

This is why I want to make the user reversessh bulletproof in terms of server-security. The user should not be able to read, write or access any file on my remote-ubuntu-server. Also it should not be able to run any Linux-Tool (for example start the python-interpreter and do devil-stuff).

How should I create such an uncommon user? Any suggestions on how to maybe solve this better?

0

They can't read the users password, they can read the hash of it, and try and reverse calculate it. Also, nothing is ever bullet proof.

That said I think you can do this just with usermod -s /sbin/nologin reversessh however this shouldn't stop them even being able to login for the purposes of reverse tunneling.

Also, you can lock the user so they have 'no' password, passwd -l reversessh - This way there's nothing to crack. This presumes your using key logins and not password authentication.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy