0

I created a Raspbian-Image which is used by a bunch of friends, colleagues and other nerds. They run it at home on their own Raspberry Pi's. However, I need SSH-Access to that Raspberry Pis to be able to debug problems in their environment. So I decided to set up a Reverse-SSH-Tunnel, that my users can activate to give me temporary access. Currently I'm working with this tutorial: https://linuxhostsupport.com/blog/how-to-setup-reverse-ssh-tunnel-on-linux/

In the first command of the tutorial it says:

ssh -R 24553:localhost:22 user@111.111.111.111

However, this means that I need to set up a new user on the Remote-Ubuntu-Server for the reverse-ssh-tunnel. So I created a new user:

useradd reversessh

Problem is, that my code is fully open-source! Everyone should be able to read and modify it anytime. Everyone has root-access on their own Pi. This is why the password of user "reversessh" will be readable for everyone who got the code/image.

This is why I want to make the user reversessh bulletproof in terms of server-security. The user should not be able to read, write or access any file on my remote-ubuntu-server. Also it should not be able to run any Linux-Tool (for example start the python-interpreter and do devil-stuff).

How should I create such an uncommon user? Any suggestions on how to maybe solve this better?

migrated from security.stackexchange.com Feb 25 at 17:38

This question came from our site for information security professionals.

0

They can't read the users password, they can read the hash of it, and try and reverse calculate it. Also, nothing is ever bullet proof.

That said I think you can do this just with usermod -s /sbin/nologin reversessh however this shouldn't stop them even being able to login for the purposes of reverse tunneling.

Also, you can lock the user so they have 'no' password, passwd -l reversessh - This way there's nothing to crack. This presumes your using key logins and not password authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy