Unix Shell/SSH config to allow TCP port forwarding without showing a command prompt

Question

I'm running a Debian Linux. I'd like to have a user account that is able to connect via SSH for TCP-forwarding only, without a command prompt.

e.g the following would work (from a remote computer):

ssh -D1234 user@myhost

but no command prompt would appear.

Using a shell like /bin/false or /sbin/nologin is too restrictive as it doesn't even allow the user to log in. A shell that only allows the "exit" or Ctrl+D commands would do the job.

I know that something similar is possible to allow only SFTP, but I can't find the equivalent for TCP forwarding.

Thanks

Answer 1

It sounds like you're looking for the -N option:

-N      Do not execute a remote command.  This is useful 
        for just forwarding ports (protocol version 2 only).

Like so:

ssh -D 8080 -N [email protected]

Also of some interest might be the -f option:

 -f      Requests ssh to go to background just before command execution.  
         This is useful if ssh is going to ask for passwords or passphrases, 
         but the user wants it in the background.  This implies -n. 
         The recommended way to start X11 programs at a remote site is 
         with something like ssh -f host xterm.

If you want to restrict what inbound connections can:

• Set up a custom command in your authorized_keys file (assuming you're using ssh keys)
• Change your user's shell

What command/shell you use depends on what you want to allow. For example:

• /bin/cat will hold the connection open but do absolutely nothing
• rssh will allow you to customize what actions are available
• A chroot jailed shell will provide similar customizability
• bash can be run in restricted mode (rbash) which only allows you to run commands in your configured PATH. It's not foolproof, but it's worth more than nothing.

Answer 2

I'm not sure if this will do. I have a cluster where I want people to work on front-end but that they are not allowed on computational nodes. All people have accounts on all computers, however, the nodes have a following lines in /etc/profile:

if test "$TERM" != "linux" && test "$USER" != "root" ;then
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""
  echo -e "\\033[0;31m         Login to this host is allowed for administrator only.\\033[0;39m"
  echo -e "            Please use \\033[0;34mqueue\\033[0;39m to submit your jobs instead"
  echo -e "    or \\033[0;34m132.187.71.6\\033[0;39m or  \\033[0;34m132.187.71.7\\033[0;39m to login into cluster front-end."
  echo ""
  echo -e "\\033[0;34m=======================================================================\\033[0;39m"
  echo ""
exit
fi

The part with $TERM checks if login was direct (i.e. with ssh) or via queueing system. The last one is allowed. If you want a specific user to be allowed to login you can add to the if-statment && test "$USER" != "someuser"