I need to remontely log on to few peoples machines to do maintanance tasks, but sometimes the machines can be behind firewalls or NAT's.
The way I have been doing it is to give the user advice on how to log in to my system with SSH so that reverse tunneling is enabled, like “use the command
ssh -R 12345:localhost:22 firstname.lastname@example.org and log in with the password
Now, this works fine, but for the sake of safety I need to go and disable the ssh login for user
uremonte when I am done, and remember to re-enable it when I need it again, or else someone might log into my administation frontend machine unwanted, or said legitimite users might try to mess around while I am using the tunnel.
I thought of setting the user shell in
/bin/cat, so anyone logging in does not get chance to do anything on the shell, and still the connection would stay alive for the reverse tunnel. This seems to be OK, but I would like to be sure this does not punch any holes in my system.
So, the question is, is this absolutely safe? Is there any way somebody logging in to this account could break away from the cat-trap?