3

I need to make a linux user for the sole purpose of an SSH proxy. Amongst other things, the user should not be able to go around exploring the filesystem or even access a shell really.

Obviously I could just chmod remove all read/write/execute permissions for everything, but that's obviously a pretty bad and potentially time consuming option.

The only connection using this user should be via ssh -D [email protected]

I'm running Debian 7.

2
  • Remove all groups except ssh. But the user may still be able to view directories if they are marked as --x for òthers Jul 18, 2016 at 6:54
  • I prefer not to have to rely on that as I have some directories such as shared folders to be used locally on the computer that I'd prefer this new user so that it can't execute anything. For now I would settle for a fake "shell" that'll keep the ssh connection open without allowing the user to actually do anything.
    – Alex
    Jul 18, 2016 at 7:24

2 Answers 2

5

If the user is going to log in, they're going to have to be able to read some bits of the file system. You simply can't launch an interactive shell without access to certain files.

If all they need to do is authenticate far enough to tunnel other connections (including, as in this case, taking advantage of the ssh SOCKS proxying facility), it's better to deny the user an interactive shell (eg, usermod -s /sbin/nologin account), then have them authenticate without interaction (ssh -N -D 23456 [email protected]).

Don't forget that ssh -D requires a port number to bind the local SOCKS proxy to, so the example in your question is syntactically invalid.

0

Could you use a chrooted ssh user or group instead? I've never implemented it myself, but it seems this may help: https://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

The tutorial is for Lenny, but hopefully this wouldn't of changed too much.

1
  • 2
    Please don't provide link-only answers.
    – gxx
    Jul 18, 2016 at 8:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .