Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my Debian system, I'd like to create a user that is only allowed to do a Reverse Port Forward from their machine to my server, but I'm not sure how to create a limited user specifically for this purpose.

For example, we'll call my server 'Sam' and my laptop 'Luke'. I'd like a user on Luke to be able to execute a reverse port forward ssh command to Sam, so that port 4321 on Sam is tunneled to port 4321 on Luke. For example:

ssh -fnR 4321:localhost:4321 -l limitedUser Sam

How can I create a user on Sam that is only allowed to execute this command?

share|improve this question
add comment

3 Answers 3

up vote 2 down vote accepted

The document I always look to on complicated SSH stuff is this one on doing passphraseless SSH right.

The important things are to restrict with command= on .ssh/authorized_keys and to set their shell to /bin/nologin. I'm not sure off the top of my head what the name of the reverse forward command would be. You might not even need one, in which case just make the command nologin or logout or something.

share|improve this answer
    
that's going to help a lot. I didn't realize the authorized_keys file format had so many options. Thanks. –  drfloob Apr 2 '10 at 23:45
add comment

To be more precise just add permitopen="host:port" ssh-rsa yourrsakey. That will restrict port forwarding to one host:port only

share|improve this answer
    
This restricts local port forwarding. The OP is asking about remote port forwarding. –  bstpierre Nov 17 '10 at 2:06
add comment

You might also be interested in the Match keyword in sshd_config: http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config

It might be better if you have lots of users with similar privileges, and safer in some contexts, since /etc/sshd_config is only root-writable, yet ~/.ssh/ is not ALWAYS read-only for users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.