I have an Ubuntu server that is used for two primary purposes for my students:
- To hold on to files that students need to temporarily upload for my assessment (ie: I give them an input image, and they upload their homework MATLAB
.m
files and the output images, which is just my original image that they have run through their code). - To serve as a proxy for students needing to access pages the school blocks (for whatever stupid reason). I've provided instructions for students using Ubuntu and Windows (via puTTY) to create an SSH tunnel and how to use FoxyProxy with Firefox to make use of the proxy.
All students are required to generate a public/private key pair, they give me the public key, which I add to the authorized_keys
files for their account on my Ubuntu server. They are required to have the private key encrypted with a strong password, and not to share it with other students.
I currently have the single entry in authorized_keys
for each account prefixed with no-pty
, so the students are able to login to the server as a proxy, and use SFTP to upload files to the server. This is exactly the setup I need.
However, going forward, I may enable telnet and FTP on the server for a restricted number of accounts. If I want to prevent any service from having an interactive shell, I can just add /sbin/nologin
or /dev/null
to /etc/shells
, and set the default shell for individual users to /etc/passwd
, but this breaks the proxy and SFTP setup, but apparently allows FTP to work without allowing interactive logins.
Is there a way to just set "no interactive shells" in a single location, or should I abandon setting up telnet and FTP, and just stick to my SFTP setup? The only reason I'm considering FTP and telnet, which are much less secure than SFTP to my knowledge, is that some students are behing firewalls which prevent outgoing SSH connections.
Thank you.