I am deploying demo Ubuntu 10.04 LTS servers in environments I do not control and would like to have an easy and secure way to administer these machines without having to have the destination firewall forward port 22 for SSH access.

I've found a few guides to do this with reverse port (e.g. howtoforge reverse ssh tunneling guide) but I'm concerned with security of the stored ssh credentials required for the tunnel to be opened automatically.

If the machine is compromised (primary concern is physical access to the machine is out of my control) how can I stop someone from using the stored credentials to poke around in the reverse ssh tunnel target machine?

Is it possible to secure this setup, or would you suggest an alternate method?


You can use autossh to maintain a reverse tunnel which will allow you to log in with SSH. The tunnel should be created with an SSH key which has restrictions in ~/.authorized_keys so that the only thing it can do is setup the tunnel (see man authorized_keys for details). The following would only allow this key to be used from, and not allow any commands to be executed with it.

from="",command="/bin/false",no-agent-forwarding,no-pty,no-X11-forwarding ssh-rsa AAAA...
  • after a bit of testing I got this working reliably with "command="/bin/false",no-agent-forwarding,no-pty,no-X11-forwarding," I also changed the sshd_config to Match User jdoe ForceCommand /bin/false when connecting using ssh client, it seems you need -N to keep the connection open once /bin/false returns – bVector Mar 27 '12 at 7:40

I'd use OpenVPN, because I know what it does and I know it can do exactly what I need, and can easily be secured -- as you rightly state, by default an SSH credential will get you onto the machine itself, which is not a wonderful idea. I know newer versions of SSH provide some sort of generic VPN functionality, and no doubt there are great ways to secure that from doing things you don't want it to, but I wouldn't be taking the risk, myself. Go with what you know.


Make a hole in your firewall or set up a proxy on a bypass. Yes you can have reverse ssh connections - but this is just a tunnelled socket connection - you still need to run some protocol over it (yes you could run ssh on top of the ssh connection, or you could even run pppd for a vpn connection) - trying to maintain / reinstate the connection when one end goes down will be very difficult to automate. Its only going to work if you build a lot of code around it - at which point you may be undermining the security. It's really not worth the effort.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.