How can I allow ssh tunneling but not a shell? Or equivelent...

nomb · 12-27-2007, 09:58 AM

Hey how can I allow people to forward ports with ssh from my server using ssh -L but not allow them to have an actual shell that they can login to and run commmands?

thanks very much,

nomb

David1357 · 12-27-2007, 11:01 AM

Quote:

Originally Posted by nomb

Hey how can I allow people to forward ports with ssh from my server using ssh -L but not allow them to have an actual shell that they can login to and run commmands?

Can't you just set their shell in "/etc/passwd" to "/bin/false"?

nomb · 12-28-2007, 09:42 AM

That didn't work. And using /bin/nologin doesn't work because ssh needs to login. Someone suggested changing the shell in /etc/passwd to a script that chrooted the user's home directory. I can write the bash script, but how would I edit the passwd file? Changing '/bin/bash' to 'sh /etc/chroot_script' didn't work and infact killed my ability to login since I'm only allowing RSA keys.

Thanks,
nomb

slimm609 · 01-02-2008, 10:18 AM

sorry it took so long to reply.

this solution should work just fine.

name the file what ever you want but for this is will use sshtrap

/bin/sshtrap

Code:

#!/bin/bash

trap "" SIGINT SIGQUIT SIGTERM SIGHUP
trap "" SIGTRAP SIGSTOP SIGKILL SIGTSTP 


echo "This is a restricted shell"
echo "Please leave this window open while using port forwarding"

echo -e "type \"EXIT\" to exit\n"; read ANSWER

while [ "$ANSWER" != "EXIT" ]; do
   echo -e "type \"EXIT\" to exit\n"; read ANSWER
done

kill -9 `ps | awk '{ print $1 }'`

chmod +x /bin/sshtrap

then add

/bin/sshtrap to the end of the home users .bashrc file.

That will trap ctrl+c, ctrl+d, ctrl+z, etc. and they can still use ssh port forwarding.

let me know if it works