I created a Raspbian-Image which is used by a bunch of friends, colleagues and other nerds. They run it at home on their own Raspberry Pi's. However, I need SSH-Access to that Raspberry Pis to be able to debug problems in their environment. So I decided to set up a Reverse-SSH-Tunnel, that my users can activate to give me temporary access. Currently I'm working with this tutorial: https://linuxhostsupport.com/blog/how-to-setup-reverse-ssh-tunnel-on-linux/
In the first command of the tutorial it says:
ssh -R 24553:localhost:22 email@example.com
However, this means that I need to set up a new user on the Remote-Ubuntu-Server for the reverse-ssh-tunnel. So I created a new user:
Problem is, that my code is fully open-source! Everyone should be able to read and modify it anytime. Everyone has root-access on their own Pi. This is why the password of user "reversessh" will be readable for everyone who got the code/image.
This is why I want to make the user reversessh bulletproof in terms of server-security. The user should not be able to read, write or access any file on my remote-ubuntu-server. Also it should not be able to run any Linux-Tool (for example start the python-interpreter and do devil-stuff).
How should I create such an uncommon user? Any suggestions on how to maybe solve this better?