3

I have a requirement to set up a SSH tunnel between two hosts. SSH server runs on a Linux host, and the SSH client (PuTTY) runs on a Windows host.

I have set up a separate user account (say 'tunnel') on the Linux machine to allow this. This user is not supposed to execute any commands but will only keep the SSH connection for tunneling when logged in from PuTTY. For that particular reason, I have set /usr/bin/passwd as the login shell for this user.

My question is, Is this a good practice in terms of security when it comes to a SSH tunnel? I couldn't find much information on the Internet about this setup but read that this shell can be used on a file sharing server.

Improve this question

3 Answers 3

Reset to default
8

In general, we set the shell to /bin/false and provide the -N option when creating the tunnel, something like;

ssh -D 4444 -N -i ~/keys/user_id_rsa [email protected]

The -N switch tells ssh not to execute any commands upon connection, without it your connection will immediately close due to the /bin/false shell.

You could use /bin/rbash to provide some basic functionality, but if you only want to be able to tunnel, I would advise against it.

Improve this answer
2
  • In my case the SSH client needs to be run on a Windows host. That's why I'm using PuTTY. I checked whether the -N options is available in PuTTY. It's available at Connection --> SSH category, under Protocol Options. Yes, I think I can do it with /bin/false rather than passwd.
    – Shaakunthala
    Mar 29, 2013 at 11:22
  • @Shaakunthala you can run putty with pretty much the same invocation as you can ssh, I believe the above should work exactly as it is, no need for the gui.
    – lynks
    Mar 31, 2013 at 10:08
1

/usr/bin/passwd is to facilitate changing of user's password. If you use it as shell of the user, the user will not be able to login but will be able to (or putting it more correctly, always be forced to) change his/hber password at every login attempt.

what you need is some sort of a restricted shell, from which the only command the user should be able to execute is exit command and may be one or two additional commands related to checking tunnel status etc, if necessary.

google the term "linux restricted shell" and you will see quite few pages, explaining how to set up one

Improve this answer
0

This type of situation is perfect for a chroot scenario. You would set up a special chroot account and installation such that you create a nice jail scenario. I think this is much better solution in the end. Here are some links.

https://serverfault.com/questions/39997/how-can-i-chroot-ssh-connections http://allanfeid.com/content/creating-chroot-jail-ssh-access

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .