Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How can I restrict a user on the ssh server to allow them only the priviledges for SSH TUNNELING? i.e. So they cannot run commands even if they log in via ssh.

My Linux servers are Ubuntu 11.04 and OpenWrt.

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

On the server side, you can restrict this by setting their user shell to /bin/true. This will allow them to authenticate, but not actually run anything since they don't get a shell to run it in. This means they will be limited to whatever subset of things SSH is able to offer them. If it offers port forwarding, they will still be able to do that.

On the client side, you will probably want to connect with the -N. This stops the client from ASKING for a remote command such as a shell, it just stops after the authentication part is done. Thanks to commentors for pointhing this out.

share|improve this answer
    
I will try this one out:P thx! –  LanceBaynes Jun 3 '11 at 9:41
1  
To add to Caleb's answer, you may also need to tell the client to not to execute a shell. With the openssh command line, this is done with the -N flag. There is a similar option in PuTTY, but I don't recall the exact name. –  Bill B Jun 3 '11 at 19:28
    
hmm, that's basically client side security, no? I'm searching for a server side security setting, but thank you! –  LanceBaynes Jun 3 '11 at 23:29
1  
Sorry, I wasn't clear - I meant in combination with the server setting. It's been my experience in the past that if you set the shell to something that's not a shell, you can't connect at all because it tries to open a shell but can't. So the security is enforced on the server side (using Caleb's method) but if you have issues connecting after that, you may need to set the client-side switch. –  Bill B Jun 4 '11 at 4:44
add comment

I'm new to Linux but I got the right idea from others in this forum and I have tested it. It worked OK for my tests. Please try this: http://www.mariovaldez.net/software/sleepshell/.

share|improve this answer
1  
Please do not just post links; include enough relevant detail so that your answer is self-contained. –  jasonwryan Jul 15 '13 at 6:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.