I am trying to set up a new user account I can give to friends so they can SSH into my forward computer, and only allow forwarding of certain ports.

I do not want my friends to have a shell, or be able to change what ports to where they are allowed to forward.

example session: joe(friend) connects using PuTTY (that I have pre-set, he isn't good with computers) to example.com(my Internet facing computer) forwarding ports 8080,1990,25565 to him(with what ever end ports he wants, preferably they stay the same numbers) example ssh command to do similar (but he can still change the ports on my computer!)

ssh -N restricteduser@example.com -p443 -L8080: -L1990: -L25565:

then, same story with other friend smith(same ports, same user even) except he is using linux, so cant use putty.

is it possible to also leave default SSH functinality for all other users but this one?

I found this when I was searching google, but alas, I did not quite understand what was being suggested, and I don't think they covered restricting port forwarding

  • Good question.. – atx Jan 29 '11 at 4:46

The simplest way that comes to mind for me is to disable SFTP, and change the shell to /usr/sbin/nologin or the like (a program that simply prints "This account is currently not available." and exits)

If you have no worries about them storing files under their user on your machine, then you're an /etc/passwd away from a solution. If you're worried about them filling your hard drive with junk, might I suggest setting up quotas? ;)

As to restricting ports usable, the "permitopen" in sshd_config should serve that purpose nicely. It won't quite do what you want, as it can only disallow all except a given set of host targets for -L forwards, but it might be feasible to run a separate sshd specifically for these users, given you have such specific needs for their restriction.

| improve this answer | |
  • will try, sounds like it might work. if this works well enough i will select it as the answer. – admalledd Jan 29 '11 at 5:24
  • problems with this as I tried it: shell for new user should be /bin/rbash, with a modified $PATH to blank, disallowing any and all commands, while also not have the ssh session closed upon connect (as with /user/sbin/nologin ) and use the match $username in sshd config works nicely to change all the settings needed on a per user basis. – admalledd Jan 30 '11 at 0:42
  • 1
    With -N, a remote shell should never be started, (This might actually need -T, but I don't think so.) thus nologin isn't executed for just port forwarding. Setting PATH to blank doesn't help if someone either knows how to set variables, or doesn't mind running a command with the full path of the command (e.g., /usr/bin/nmap) – Jeremy Sturdivant Jan 30 '11 at 16:45
  • because the idea is that i cant trust users to add -N I use /bin/rbash (not the 'r') you cant set environment variables, or execute commands with a '/' in them (this includes ./foo and /bin/*) – admalledd Jan 31 '11 at 4:34
  • So rather than simply booting users that don't use -N, you give them a shell that does not allow them to do anything, by some standard? You could always set their shell to /bin/cat just as easily... – Jeremy Sturdivant Jan 31 '11 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.