Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an application that uses SSH to connect to a server : the application's network traffic (database, some custom TCP protocols, etc...) is tunneled through a SSH connection.

We use a key pair and an unprivileged account on the server, but the users still can use their key to login to the server, or do whatever port redirection they want.

Is there a way to configure the SSH server to allow only some tunnels (restricted on the tunnels' end address and port), and disable shell access ? (we use OpenSSH)


I came across this article, it seems like removing shell access is not enough. Changed title and description accordingly.

share|improve this question
up vote 6 down vote accepted

In your authorized_keys file you can specify which command will be run when they login. You could simply set that command to run something that will just wait around for a long time. The sshd man page as a list of all the options you can use in your authorized_keys file.

permitopen="",no-pty,no-agent-forwarding,no-X11-forwarding,command="/usr/local/" ssh-rsa AAAAB3....

My is this (it also enforces a 12 hour timeout). I am not 100% sure if this is completely secure.


# send a hang-up after this process exits
shopt -s huponexit
# maximum session length in hours
sleep $[CONNECT_TIME*60]
kill $PPID
share|improve this answer
Not so keen on the additional shell script, but the first part is the right answer. – Dan Carley Jun 3 '09 at 18:20
I should probably post as a separate question, but are there other ways to limit the total connect time? – Zoredache Jun 3 '09 at 18:22
Not that I'm aware of, using oSSH alone. The only timeouts relate to automatic keepalives. Bash has such a variable, but that's no use, because the shell should of course be /bin/false or equivilant. – Dan Carley Jun 3 '09 at 18:28
permitopen is what I was looking for, thanks. What exactly is the advantage of your script over /bin/false when used in combination with permitopen ? (besides limiting sessions duration) – Luper Rouch Jun 3 '09 at 18:37

Setting the user's shell to /bin/false may do what you're looking for.

share|improve this answer

Maybe the "ChrootDirectory" keyword in the sshd_config (man sshd_config) might give a little more extra security.

share|improve this answer

I believe you could set the ForceCommand directive to /bin/false to prevent shell access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.