<p>I'd like to allow a user to set up an SSH tunnel to a particular machine on a particular port (say, 5000), but I want to restrict this user as much as possible. (Authentication will be with public/private keypair).</p>

<p>I know I need to edit the relevant ~/.ssh/authorized_keys file, but I'm not sure exactly what content to put in there (other than the public key).</p>

[{'answer_id': 8023, 'author': 'Michael Pryor', 'author_id': 245, 'author_profile': 'https://Stackoverflow.com/users/245', 'pm_score': -1, 'selected': False, 'text': '<p>See <a href="http://www.networknewz.com/networknewz-10-20030707AuthenticatingbyPublicKeyOpenSSH.html" rel="nofollow noreferrer">this post on authenticating public keys</a>.</p>\n\n<p>The two main things you need to remember are:</p>\n\n<ol>\n<li>Make sure you <code>chmod 700 ~/.ssh</code></li>\n<li>Append the public key block to authorized-keys</li>\n</ol>\n'}, {'answer_id': 8025, 'author': 'palehorse', 'author_id': 312, 'author_profile': 'https://Stackoverflow.com/users/312', 'pm_score': -1, 'selected': False, 'text': "<p>You will generate a key on the users machine via whatever ssh client they are using.  pUTTY for example has a utility to do this exact thing.  It will generate both a private and public key.</p>\n\n<p>The contents of the public key file generated will be placed in the authorized_keys file.</p>\n\n<p>Next you need to make sure that the ssh client is configured to use the private key that generated the public key.  It's fairly straight forward, but slightly different depending on the client being used.</p>\n"}, {'answer_id': 8363, 'author': 'Jason Day', 'author_id': 737, 'author_profile': 'https://Stackoverflow.com/users/737', 'pm_score': 4, 'selected': False, 'text': '<p>You\'ll probably want to set the user\'s shell to <a href="http://www.gnu.org/software/bash/manual/html_node/The-Restricted-Shell.html" rel="noreferrer">the restricted shell</a>. Unset the PATH variable in the user\'s ~/.bashrc or ~/.bash_profile, and they won\'t be able to execute any commands.  Later on, if you decide you want to allow the user(s) to execute a limited set of commands, like <code>less</code> or <code>tail</code> for instance, then you can copy the allowed commands to a separate directory (such as <code>/home/restricted-commands</code>) and update the PATH to point to that directory.</p>\n'}, {'answer_id': 181726, 'author': 'Zoredache', 'author_id': 20267, 'author_profile': 'https://Stackoverflow.com/users/20267', 'pm_score': 2, 'selected': False, 'text': '<blockquote>\n  <p>I\'m able to set up the authorized_keys file with the public key to log\n  in. What I\'m not sure about is the additional information I need to\n  restrict what that account is allowed to do. For example, I know I can\n  put commands such as:</p>\n\n<pre><code>no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding\n</code></pre>\n</blockquote>\n\n<p>You would want a line in your authorized_keys file that looks like this.</p>\n\n<pre><code>permitopen="host.domain.tld:443",no-pty,no-agent-forwarding,no-X11-forwardi\nng,command="/bin/noshell.sh" ssh-rsa AAAAB3NzaC.......wCUw== zoredache \n</code></pre>\n'}, {'answer_id': 4202812, 'author': 'marbu', 'author_id': 510536, 'author_profile': 'https://Stackoverflow.com/users/510536', 'pm_score': 4, 'selected': False, 'text': '<p>Besides authorized_keys option like no-X11-forwarding, there actually is exactly one you are asking for: permitopen="host:port". By using this option, the user may only set up a tunnel to the specified host and port.</p>\n\n<p>For the details of the AUTHORIZED_KEYS file format refer to man sshd.</p>\n'}, {'answer_id': 10266397, 'author': 'Paul', 'author_id': 103081, 'author_profile': 'https://Stackoverflow.com/users/103081', 'pm_score': 8, 'selected': True, 'text': '<p>On Ubuntu 11.10, I found I could block ssh commands, sent with and without -T, and block scp copying, while allowing port forwarding to go through. </p>\n\n<p>Specifically I have a redis-server on "somehost" bound to localhost:6379 that I wish to share securely via ssh tunnels to other hosts that have a keyfile and will ssh in with:</p>\n\n<pre><code>$ ssh -i keyfile.rsa -T -N -L 16379:localhost:6379 someuser@somehost\n</code></pre>\n\n<p>This will cause the redis-server, "localhost" port 6379 on "somehost" to appear locally on the host executing the ssh command, remapped to "localhost" port 16379. </p>\n\n<p>On the remote "somehost" Here is what I used for authorized_keys:</p>\n\n<pre><code>cat .ssh/authorized_keys   (portions redacted)\n\nno-pty,no-X11-forwarding,permitopen="localhost:6379",command="/bin/echo do-not-send-commands" ssh-rsa rsa-public-key-code-goes-here keyuser@keyhost\n</code></pre>\n\n<p>The no-pty trips up most ssh attempts that want to open a terminal.  </p>\n\n<p>The permitopen explains what ports are allowed to be forwarded, in this case port 6379 the redis-server port I wanted to forward.</p>\n\n<p>The command="/bin/echo do-not-send-commands" echoes back "do-not-send-commands" if someone or something does manage to send commands to the host via ssh -T or otherwise.  </p>\n\n<p>From a recent Ubuntu <code>man sshd</code>, authorized_keys / command is described as follows:</p>\n\n<blockquote>\n  <p>command="command"\n               Specifies that the command is executed whenever this key is used\n               for authentication.  The command supplied by the user (if any) is\n               ignored.</p>\n</blockquote>\n\n<p>Attempts to use scp secure file copying will also fail with an echo of "do-not-send-commands" I\'ve found sftp also fails with this configuration.  </p>\n\n<p>I think the restricted shell suggestion, made in some previous answers, is also a good idea.\nAlso, I would agree that everything detailed here could be determined from reading "man sshd" and searching therein for "authorized_keys" </p>\n'}, {'answer_id': 15845908, 'author': 'joseph_morris', 'author_id': 720763, 'author_profile': 'https://Stackoverflow.com/users/720763', 'pm_score': 2, 'selected': False, 'text': '<p>If you want to do allow access only for a specific command -- like svn -- you can also specify that command in the authorized keys file:</p>\n\n<pre><code>command="svnserve -t",no-port-forwarding,no-pty,no-agent-forwarding,no-X11-forwarding [KEY TYPE] [KEY] [KEY COMMENT]\n</code></pre>\n\n<p>From <a href="http://svn.apache.org/repos/asf/subversion/trunk/notes/ssh-tricks" rel="nofollow">http://svn.apache.org/repos/asf/subversion/trunk/notes/ssh-tricks</a></p>\n'}, {'answer_id': 15990251, 'author': 'Daniel W.', 'author_id': 1948292, 'author_profile': 'https://Stackoverflow.com/users/1948292', 'pm_score': 3, 'selected': False, 'text': '<p>My solution is to provide the user who only may be tunneling, <strong>without an interactive shell</strong>, to set that shell in <strong>/etc/passwd</strong> to <strong>/usr/bin/tunnel_shell</strong>.</p>\n\n<p>Just create the executable file <strong>/usr/bin/tunnel_shell</strong> with an <strong>infinite loop</strong>.</p>\n\n<pre><code>#!/bin/bash\ntrap \'\' 2 20 24\nclear\necho -e "\\r\\n\\033[32mSSH tunnel started, shell disabled by the system administrator\\r\\n"\nwhile [ true ] ; do\nsleep 1000\ndone\nexit 0\n</code></pre>\n\n<p><strong>Fully explained here:</strong> <a href="http://blog.flowl.info/2011/ssh-tunnel-group-only-and-no-shell-please/">http://blog.flowl.info/2011/ssh-tunnel-group-only-and-no-shell-please/</a></p>\n'}, {'answer_id': 26964042, 'author': 'fangfufu', 'author_id': 4259370, 'author_profile': 'https://Stackoverflow.com/users/4259370', 'pm_score': 0, 'selected': False, 'text': '<p>I made a C program which looks like this:</p>\n\n<pre><code>#include &lt;stdio.h&gt;\n#include &lt;unistd.h&gt;\n#include &lt;signal.h&gt;\n#include &lt;stdlib.h&gt;\nvoid sig_handler(int signo)\n{\n    if (signo == SIGHUP)\n        exit(0);\n}\n\nint main()\n{\n    signal(SIGINT, &amp;sig_handler);\n    signal(SIGTSTP, &amp;sig_handler);\n\n    printf("OK\\n");\n    while(1)\n        sleep(1);\n    exit(0);\n}\n</code></pre>\n\n<p>I set the restricted user\'s shell to this program. </p>\n\n<p>I don\'t think the restricted user can execute anything, even if they do <code>ssh server command</code>, because the commands are executed using the shell, and this shell does not execute anything. </p>\n'}, {'answer_id': 30217592, 'author': 'juanmf', 'author_id': 711855, 'author_profile': 'https://Stackoverflow.com/users/711855', 'pm_score': 3, 'selected': False, 'text': '<p>Here you have a nice post that I found useful:\n<a href="http://www.ab-weblog.com/en/creating-a-restricted-ssh-user-for-ssh-tunneling-only/" rel="noreferrer">http://www.ab-weblog.com/en/creating-a-restricted-ssh-user-for-ssh-tunneling-only/</a></p>\n\n<p>The idea is: (with the new restricted username as "sshtunnel")</p>\n\n<pre><code>useradd sshtunnel -m -d /home/sshtunnel -s /bin/rbash\npasswd sshtunnel\n</code></pre>\n\n<p>Note that we use rbash (restricted-bash) to restrict what the user can do: the user cannot cd (change directory) and cannot set any environment variables.</p>\n\n<p>Then we edit the user\'s PATH env variable in <code>/home/sshtunnel/.profile</code> to nothing - a trick that will make bash not find any commands to execute:</p>\n\n<pre><code>PATH=""\n</code></pre>\n\n<p>Finally we disallow the user to edit any files by setting the following permissions:</p>\n\n<pre><code>chmod 555 /home/sshtunnel/\ncd /home/sshtunnel/\nchmod 444 .bash_logout .bashrc .profile\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/8021', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/742/']