8

So I've added a public key to authorized_keys. How can I limit it so that it may forward ports but it may not have a shell?

10

You have to add no-pty,command="/bin/false" keyword before your key so it will look like this:

no-pty,command="/bin/false" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABBACzbcwCZNaN3HhHmpnaVrfZlNJ0HhPnOqEj
k2llms1OOPnEXetIlZuJw0UXbyMbhQbBl/E2wxXvXvF+jyLRR5yN6kBydM4LhjC0ej0PcH839vXd
uwJpDFjPw3s7r0VOhU1WRyk6Da6rX6shzabhQioIm3MHCjNOdywPb0k1cTj4yOxoOCOqGjmXK0
xxzTd+ZjTJqQGWzZ+8L8cVtKmU8kspYlCdhGWSv0Den36OsScnWTBn8A3X3lVJB5NkEm
BM1yKX4F6BhhD317VensEUu031PtFULeSF97IxDPmK36OFz9TPSf4d8Hp3BqtysqUlbWfEhYdHXj
+1Mn4xXZKiZhBh1DX youruser@yourhome

(This is all in a single line, I added the line breaks for readability).

  • 5
    That restricts the ability to have a remote login, it does not prevent remote execution of commands. Src: marc.info/?l=openssh-unix-dev&m=111143581515782&w=2 – mctylr Apr 13 '10 at 19:52
  • 1
    @mctylr: that was not part of the question. But you are right maybe the OP was not aware of that, so I added that to the answer. (+1) – cstamas Apr 16 '10 at 8:42
  • 1
    Also worth noting is that you need to use 'ssh -N' to keep the tunnel up when there is no shell at the remote end. – Mike Pountney Dec 5 '11 at 14:05
1

man sshd

Section AUTHORIZED_KEYS FILE FORMAT. You can restrict what users can port forward to simply by adding the ports and hosts you want to allow, like

permitopen="192.0.2.1:80"

Also you can restrict where do the user connect from, which commands can execute, etc.

1

I would look at using scponly, I suspect it can be used for port forwarding rather than scp/sftp-only access. It is intended to restrict the user from logging in or executing commands via ssh.

The other factor you may need to, or want to, use sshd in a chroot'ed environment, here are some instructions on setting up sftp using chroot. You should be able to adapt them fairly easily.

I hope that helps you find your solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.