Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a client does not execute a command (e.g. with -N) within some timeframe (1-2 seconds) after establishing the SSH connection, I'd like to terminate it from the server.

Unfortunately, ForceCommand and authorized_keys-prefixed commands do not execute either when run with -N, but clients could still conceivably request remote forwards (-R) tying up ports on your server.

I'd like to prevent this scenario but prefixing the keys with no-port-forwarding isn't an option because if they run a command I want to allow port forwarding. In this case my forced command executes and I can do validation to ensure that it is allowed.

Is my only option having some external process monitor sshd instances and check if they have any child processes (e.g. shell or executed command)?

share|improve this question
    
Did you manage to get this to wotk? – Paulo Arruda Nov 13 '14 at 6:56
    
@PauloArruda not to my recollection. I experimented with a monitor of sorts and then lost interest in the project. Sorry :( – Bo Jeanes Mar 19 '15 at 5:43
    
I solved it on my website Burrow.io using shell scripts. – Paulo Arruda Mar 24 '15 at 21:21
    
@PauloArruda nice. Do you want to add an answer that describes what you're doing maybe with some critical code snippets. I'll accept it as the answer for the question if you do. – Bo Jeanes Mar 26 '15 at 21:27

If you say that -N works always, then there is no other option besides having external process monitor the childs of sshd. I have checked the man page for sshd_config and didn't find any option which would help you. Also it doesn't specify if -N should work with ForceCommand or not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.