Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.

I have set up a separate user account (say 'tunnel') on the Linux machine to allow this. This user is not supposed to execute any commands but will only keep the SSH connection for tunneling when logged in from PuTTY. For that particular reason, I have set /usr/bin/passwd as the login shell for this user.

My question is, Is this a good practice in terms of security when it comes to a SSH tunnel? I couldn't find much information on the Internet about this setup but read that this shell can be used on a file sharing server.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

In general, we set the shell to /bin/false and provide the -N option when creating the tunnel, something like;

ssh -D 4444 -N -i ~/keys/user_id_rsa user@remote.com

The -N switch tells ssh not to execute any commands upon connection, without it your connection will immediately close due to the /bin/false shell.

You could use /bin/rbash to provide some basic functionality, but if you only want to be able to tunnel, I would advise against it.

share|improve this answer
    
In my case the SSH client needs to be run on a Windows host. That's why I'm using PuTTY. I checked whether the -N options is available in PuTTY. It's available at Connection --> SSH category, under Protocol Options. Yes, I think I can do it with /bin/false rather than passwd. –  Shaakunthala Mar 29 '13 at 11:22
    
@Shaakunthala you can run putty with pretty much the same invocation as you can ssh, I believe the above should work exactly as it is, no need for the gui. –  lynks Mar 31 '13 at 10:08
add comment

/usr/bin/passwd is to facilitate changing of user's password. If you use it as shell of the user, the user will not be able to login but will be able to (or putting it more correctly, always be forced to) change his/hber password at every login attempt.

what you need is some sort of a restricted shell, from which the only command the user should be able to execute is exit command and may be one or two additional commands related to checking tunnel status etc, if necessary.

google the term "linux restricted shell" and you will see quite few pages, explaining how to set up one

share|improve this answer
add comment

This type of situation is perfect for a chroot scenario. You would set up a special chroot account and installation such that you create a nice jail scenario. I think this is much better solution in the end. Here are some links.

http://serverfault.com/questions/39997/how-can-i-chroot-ssh-connections http://allanfeid.com/content/creating-chroot-jail-ssh-access

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.