So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?
You have to add no-pty,command="/bin/false" keyword before your key so it will look like this:
no-pty,command="/bin/false" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj
k2llms1OOPnEXetIlZuJw0UXbyMbhQbBl/E2wxXvXvF+jyLRR5yN6kBydM4LhjC0ej0PcH839vXd
uwJpDFjPw3s7r0VOhU1WRyk6Da6rX6shzabhQioIm3MHCjNOdywPb0k1cTj4yOxoOCOqGjmXK0
xxzTd+ZjTJqQGWzZ+8L8cVtKmU8kspYlCdhGWSv0Den36OsScnWTBn8A3X3lVJB5NkEm
BM1yKX4F6BhhD317VensEUu031PtFULeSF97IxDPmK36OFz9TPSf4d8Hp3BqtysqUlbWfEhYdHXj
+1Mn4xXZKiZhBh1DX youruser@yourhome
(This is all in a single line, I added the line breaks for readability).
-
5That restricts the ability to have a remote login, it does not prevent remote execution of commands. Src: marc.info/?l=openssh-unix-dev&m=111143581515782&w=2 – mctylr Apr 13 '10 at 19:52
-
1@mctylr: that was not part of the question. But you are right maybe the OP was not aware of that, so I added that to the answer. (+1) – cstamas Apr 16 '10 at 8:42
-
1Also worth noting is that you need to use 'ssh -N' to keep the tunnel up when there is no shell at the remote end. – Mike Pountney Dec 5 '11 at 14:05
man sshd
Section AUTHORIZED_KEYS FILE FORMAT. You can restrict what users can port forward to simply by adding the ports and hosts you want to allow, like
permitopen="192.0.2.1:80"
Also you can restrict where do the user connect from, which commands can execute, etc.
I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.
The other factor you may need to, or want to, use sshd in a chroot'ed environment, here are some instructions on setting up sftp using chroot. You should be able to adapt them fairly easily.
I hope that helps you find your solution.
-
scponlyseems to have moved to github.com/scponly/scponly . Your link gives a 404. :( – Bill Weiss Jan 13 '13 at 17:50
