Allow ssh tunnel but disallow shell

jago25_98 · 03-12-2011, 07:54 PM

I need a to allow a user to tunnel an ssh session but disallow them a bash shell.

# chsh -s /sbin/nologin {username} won't cut it...?

would permissions be the way to go with it? But how? Setup a group and add the user to that group? Or add all other users to that group... I'm confused

I don't need to chain to a new server unlike previous questions asked here.

wpeckham · 03-12-2011, 09:22 PM

Why?
I can think of no situation where a tunnel would be of significant use without a shell.
Encrypted sessions, chroot (actual or ssh/style), sftp-only, or restricted shell accounts I can understand, but why a tunnel-only account?

Check out IBSH (Iron Bound Shell) to see if it might serve your real purpose.

jago25_98 · 03-13-2011, 11:22 AM

I have friends behind various firewalls (Libya, Australia, China & a few work environements). I trust them enough to let them use my dynamic port forwarding but I´d rather not allow them a user account on the shell, fair point though

wpeckham · 03-14-2011, 09:18 AM

I think that there are better ways to do it, but if that is what you want ...

Install IBSH and make it the shell for those accounts, then configure it so that the only commands they can run are 'exit' and 'logout'.

Permit their tunnel(s).
I would also set up automatic cleansing of the logs daily, so that I help no trace of their activity more than a few hours old.