I want to give about 30 users to some people I don't trust at all on my server . I want them to be able to use their account with SSH for tunneling . They must not be able to see what's going on inside the server or executing commands . I thought of "chmod o-xr -R /" but I think It's not a good option, since other programs must be able to see somethings . any suggestions ? I saw something like "bash=/bin/null" somewhere a long time ago but I don't remember what was it and can't find it anymore

Partition the server so the needed directories have access permission but all else is denied.

need clarity on what you mean by "ssh tunneling". do you mean tunneling of applications, or just the ssh session is "tunneled" because its encrypted? what exactly do you mean by "they must not be abole to see what going on inside the server"? they cant run top or vmstat ?? if the system is in good perms shape then there shouldnt be a issue, etc. do you run SElinux?

no need to get overly complicated.

create groups, allow only those groups to ssh (lock down ssh via sshd_config, etc).
then configure sudo to allow those groups to do certain things, etc.
i chmod 700 su so only my sysadmins can sudo su, etc.

many internet websites are filtered in Iran and we can't visit them . we used VPNs ( PPTP, IPSec, etc ) to access internet of offshore servers, but now even VPN ports are blocked . ssh is seeming very nice now, this command "ssh -D 1234 -C user@myserver" and setting system proxy to 127.0.0.1:1234 allows me to surf the web now, but giving away user accounts to others is not a good idea . some issues here are disk space, bandwidth and security problems . I set other users default bash to this script :

#!/bin/sh
read -p "Some prompt"
exit

so now people can't use bash, but I'm not sure if It's enough to avoid disasters . I want them to be able to use tunneling only, nothing else

sorry for my poor English, I just can't find words to describe my problem

Unfortunately, this topic goes against rule 14 in that it is a topic that can be damaging to LQ's reputation. Regardless of how sympathetic we may be to your cause, topics involving circumventing government restrictions are not permitted. This thread has been reported to the moderators.

i dunno legal aspect of the question, but shell /bin/false and ssh -N should do it.

...then you best find out before posting, right?


As stated by Noway2 circumvention of access restrictions in the broadest meaning of the word is not a topic suitable for LQ. This thread is closed.