Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?

share|improve this question

3 Answers 3

up vote 10 down vote accepted

You have to put a no-pty keyword before your key so it will look like this:

no-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj
k2llms1OOPnEXetIlZuJw0UXbyMbhQbBl/E2wxXvXvF+jyLRR5yN6kBydM4LhjC0ej0PcH839vXd
uwJpDFjPw3s7r0VOhU1WRyk6Da6rX6shzabhQioIm3MHCjNOdywPb0k1cTj4yOxoOCOqGjmXK0
xxzTd+ZjTJqQGWzZ+8L8cVtKmU8kspYlCdhGWSv0Den36OsScnWTBn8A3X3lVJB5NkEm
BM1yKX4F6BhhD317VensEUu031PtFULeSF97IxDPmK36OFz9TPSf4d8Hp3BqtysqUlbWfEhYdHXj
+1Mn4xXZKiZhBh1DX youruser@yourhome

(This is all in a single line, I added the line breaks for readability).

UPDATE: if you want to prevent remote command execution you have to add: command="/bin/false"

no-pty,command="/bin/false" ssh-rsa ...
share|improve this answer
4  
That restricts the ability to have a remote login, it does not prevent remote execution of commands. Src: marc.info/?l=openssh-unix-dev&m=111143581515782&w=2 –  mctylr Apr 13 '10 at 19:52
1  
@mctylr: that was not part of the question. But you are right maybe the OP was not aware of that, so I added that to the answer. (+1) –  cstamas Apr 16 '10 at 8:42
1  
Also worth noting is that you need to use 'ssh -N' to keep the tunnel up when there is no shell at the remote end. –  Mike Pountney Dec 5 '11 at 14:05

man sshd

Section AUTHORIZED_KEYS FILE FORMAT. You can restrict what users can port forward to simply by adding the ports and hosts you want to allow, like

permitopen="192.0.2.1:80"

Also you can restrict where do the user connect from, which commands can execute, etc.

share|improve this answer

I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.

The other factor you may need to, or want to, use sshd in a chroot'ed environment, here are some instructions on setting up sftp using chroot. You should be able to adapt them fairly easily.

I hope that helps you find your solution.

share|improve this answer
    
scponly seems to have moved to github.com/scponly/scponly . Your link gives a 404. :( –  Bill Weiss Jan 13 '13 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.