Can I disable interactive shell access while tunneling web traffic through SSH?

Question

I am looking into implementing SSH tunneling as a cheap VPN solution for outside users to access Intranet-only facing web applications.

I currently am using Ubuntu Server 10.04.1 64 bit with OpenSSH installed.

I am using Putty on Windows boxes to create a tunnel on a local port to my ssh server.

start putty -D 9999 mysshserver.com -N

I then use tell Firefox to use a SOCKS proxy on localhost:9999.

The -N flag will disable the interactive shell from the client side. Is there a way to do this on the server side?

Besides disabling root access, using rsa key authentication, and changing the default port; are there any other obvious security practices I should follow for this purpose? My goal is to simply be able to tunnel web traffic.

Answer 1

Yes you can, as fine-grained as you can assign public keys. In addition to nologin as recommended by ajdecon, I would suggest setting the following in front of the key entry in authorized_keys:

no-pty ssh-rsa ...

The no pty tells the server-side that no pseudo-terminal should be allocated for that key.

You can also force the execution of something like nologin for a particular key by prepending this:

command="/sbin/nologin",no-pty ssh-rsa ...

Good luck.

Answer 2

For any tunnelling-only user, change their login shell to /sbin/nologin. That way your user will be unable to access a shell on the server, but will still be able to run set up ssh tunnels from their client.

Answer 3

I recommend trying Tunnelier. It's a heck of a lot easier to configure/manage.

Answer 4

I know this may not be the answer you're looking for, but have you considered using OpenVPN as an alternative?