I am currently trying to set up a user group that can connect to a server over SSH but only proxy through it. They can't see any files or run any commands. Users in the group would also be able to use password authentication instead of keys. The SSH server is OpenSSH.

This is another question that addresses something similar with a very good answer. I'm having a problem fully understanding what he means and it specifically states that users aren't allowed to use the server as a proxy so I can't mindlessly follow instructions. It is also written for a single user compared to a group. To try and address this I made the following changes to his configuration in sshd_config.

Match Group limited-users
AllowTcpForwarding yes
#X11Forwarding no
#PermitTunnel no
#GatewayPorts no
AllowAgentForwarding no
PermitOpen localhost:1080
ForceCommand echo 'This account can only be used for [reason]'

I suspect I may need to create a specific type of system group but I am not sure.

Is there a preferred way to make a locked down account like that and I'm just missing it?

Edit: I have found a second question that also closely resembles this one on StackOverflow but they again use keys where as I'd like to use passwords instead of keys.

Edit 2: Turns out this is a pretty popular thing. This one helped the most. It seems I need to simply set the user's shell to a simple press any key to log out and they won't be able to do anything.

Edit 3: When closely following this article provided by one of the other questions I have come up with the following which is pretty much the same thing but without two separate groups:

I will update if correct.

I have created what seems to be a completely useless shell by creating the file /usr/bin/tunnel_shell and putting in this

trap '' 2 20 24
echo -e "rn33[32mSSH tunnel started, shell disabled by the system administrator"
while [ true ] ; do
sleep 1000
exit 0

I created a group called tunnel_group using

groupadd tunnel_group

I added a user called tunnel_user using this. The -M gives him no home directory. The -G tunnel_group adds him to tunnel_group (a group I created earlier). -s set his shell to the tunnel_shell file I created earlier.

useradd -M -G tunnel_group -s /usr/bin/tunnel_shell tunnel_user

I then set the users password using

passwd tunnel_user

In /etc/ssh/sshd_config/ I have added this to the end of the file.

  Match Group tunnel_group
   AllowTcpForwarding yes
   #X11Forwarding no
   PermitTunnel yes
   GatewayPorts yes
   AllowAgentForwarding yes
   PermitOpen localhost: 1080
   ForceCommand echo 'This account can only be used for SOCKS and has be restricted accordingly.'
  • "proxy through it"... You want all SSH connections on that server for a particular group to become SSH connections to another server, or you want to allow those users to forward ports (aka ssh -R/L/D)? – muru Nov 18 '14 at 13:21
  • Id like them to forward ports – Griffin Nov 18 '14 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.