Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a Debian Linux. I'd like to have a user account that is able to connect via SSH for TCP-forwarding only, without a command prompt.

e.g the following would work (from a remote computer):

ssh -D1234 user@myhost

but no command prompt would appear.

Using a shell like /bin/false or /sbin/nologin is too restrictive as it doesn't even allow the user to log in. A shell that only allows the "exit" or Ctrl+D commands would do the job.

I know that something similar is possible to allow only SFTP, but I can't find the equivalent for TCP forwarding.

Thanks

share|improve this question
1  
you can add "no-pty" to in authorized_keys of the user. Or you can use "match user" in ssh_config and set force_command to something else look here: stackoverflow.com/questions/8021/… –  Tim Haegele Jun 30 '13 at 16:43
    
See: askubuntu.com/questions/48129/… –  Zoredache Jul 1 '13 at 3:07
    
@TimHaegele no-pty won't prevent the user from executing commands non-interactively, though. –  200_success Jul 1 '13 at 4:14
    
BTW, have you considered just setting up a VPN? That seems to be what you are really looking for. –  Zoredache Jul 1 '13 at 5:13
add comment

2 Answers

up vote 5 down vote accepted

It sounds like you're looking for the -N option:

-N      Do not execute a remote command.  This is useful 
        for just forwarding ports (protocol version 2 only).

Like so:

ssh -D 8080 -N foo@bar.com

Also of some interest might be the -f option:

 -f      Requests ssh to go to background just before command execution.  
         This is useful if ssh is going to ask for passwords or passphrases, 
         but the user wants it in the background.  This implies -n. 
         The recommended way to start X11 programs at a remote site is 
         with something like ssh -f host xterm.

If you want to restrict what inbound connections can:

  • Set up a custom command in your authorized_keys file (assuming you're using ssh keys)
  • Change your user's shell

What command/shell you use depends on what you want to allow. For example:

  • /bin/cat will hold the connection open but do absolutely nothing
  • rssh will allow you to customize what actions are available
  • A chroot jailed shell will provide similar customizability
  • bash can be run in restricted mode (rbash) which only allows you to run commands in your configured PATH. It's not foolproof, but it's worth more than nothing.
share|improve this answer
    
The -N and -f flags would be specified by the client, if the client voluntarily chooses not to execute anything. The question is, how can the server's sysadmin prevent the user from executing anything? –  200_success Jul 1 '13 at 4:13
    
@200_success edited to answer –  tylerl Jul 1 '13 at 4:34
    
Setting the user's terminal as /bin/false and requiring the -N option does the job. Thanks @tylerl! –  Raphael K Jul 1 '13 at 19:58
add comment

I'm not sure if this will do. I have a cluster where I want people to work on front-end but that they are not allowed on computational nodes. All people have accounts on all computers, however, the nodes have a following lines in /etc/profile:

if test "$TERM" != "linux" && test "$USER" != "root" ;then
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""
  echo -e "\\033[0;31m         Login to this host is allowed for administrator only.\\033[0;39m"
  echo -e "            Please use \\033[0;34mqueue\\033[0;39m to submit your jobs instead"
  echo -e "    or \\033[0;34m132.187.71.6\\033[0;39m or  \\033[0;34m132.187.71.7\\033[0;39m to login into cluster front-end."
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""
exit
fi

The part with $TERM checks if login was direct (i.e. with ssh) or via queueing system. The last one is allowed. If you want a specific user to be allowed to login you can add to the if-statment && test "$USER" != "someuser"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.