I am currently trying to set up a user group that can connect to a server over SSH but only proxy through it. They can't see any files or run any commands. Users in the group would also be able to use password authentication instead of keys. The SSH server is OpenSSH.
This is another question that addresses something similar with a very good answer. I'm having a problem fully understanding what he means and it specifically states that users aren't allowed to use the server as a proxy so I can't mindlessly follow instructions. It is also written for a single user compared to a group. To try and address this I made the following changes to his configuration in
Match Group limited-users AllowTcpForwarding yes #X11Forwarding no #PermitTunnel no #GatewayPorts no AllowAgentForwarding no PermitOpen localhost:1080 ForceCommand echo 'This account can only be used for [reason]'
I suspect I may need to create a specific type of system group but I am not sure.
Is there a preferred way to make a locked down account like that and I'm just missing it?
Edit: I have found a second question that also closely resembles this one on StackOverflow but they again use keys where as I'd like to use passwords instead of keys.
Edit 2: Turns out this is a pretty popular thing. This one helped the most. It seems I need to simply set the user's shell to a simple press any key to log out and they won't be able to do anything.
Edit 3: When closely following this article provided by one of the other questions I have come up with the following which is pretty much the same thing but without two separate groups:
I will update if correct.
I have created what seems to be a completely useless shell by creating the file
/usr/bin/tunnel_shell and putting in this
#!/bin/bash trap '' 2 20 24 clear echo -e "rn33[32mSSH tunnel started, shell disabled by the system administrator" while [ true ] ; do sleep 1000 done exit 0
I created a group called tunnel_group using
I added a user called tunnel_user using this. The -M gives him no home directory. The -G tunnel_group adds him to tunnel_group (a group I created earlier). -s set his shell to the tunnel_shell file I created earlier.
useradd -M -G tunnel_group -s /usr/bin/tunnel_shell tunnel_user
I then set the users password using
/etc/ssh/sshd_config/ I have added this to the end of the file.
Match Group tunnel_group AllowTcpForwarding yes #X11Forwarding no PermitTunnel yes GatewayPorts yes AllowAgentForwarding yes PermitOpen localhost: 1080 ForceCommand echo 'This account can only be used for SOCKS and has be restricted accordingly.'