Intro This is a question that seeks an extension of the answers at how-to-restrict-an-ssh-user-to-only-allow-ssh-tunneling
Problem Statement I have tried to implement the suggestion at the reference to create a user with no shell access but I could not connect to a tunnel in the name of that user.
Requirement I want to be able to have an unprotected remote computer (machine A) initiate a reverse tunnel back to my firewall. Machine A is a headless box with no user input. It is out in the wild and may be behind a firewall. My firewall (MyFW) is a linux machine and I have CLI root access.
I need Machine A to initiate a reverse ssh tunnel back to MyFW. Usually a local tunnel will be created on a user Machine C on the protected side of MyFW. The local ssh tunnel would connect to the reverse tunnel at MyFW as required.
If someone breaks into Machine A, and finds the reverse tunnel, I don't want them to be able use the reverse tunnel to gain access beyond the tunnel entrance (port) at MyFW.
What have I tried
I have used ssh and tunnels for some years, so I understand their general config and operation. For testing I setup 2 machines on my desk, machines A & B. Both are linux machines, neither is a firewall. The aim being to get the simplest setup working.
I started by creating ssh keys on machine A with:
In the usual way.
adding a user "tunnel" to the machine B acting as MyFW. The following commands were executed by another user with sudo.
useradd tunnel -m -d /home/tunnel -s /bin/true
The tunnel user does not have a password. I created a home dir because the above command does not.
I created ssh keys for the user tunnel and put them in the
I manually copied the public key from the remote machine A to the /home/tunnel/.ssh/authorized_keys file in the MyFW machine B.
I set the values in the ssh config files:
AllowTcpForwarding Yes GatewayPorts yes ExitOnForwardFailure=yes
The purpose of this was to create a user at the firewall, to create and link tunnels while blocking any access attempt by a hacker. There is nothing of value on the real remote Machine A so it wouldn't matter much if a hacker trashed it.
To test, I setup a local tunnel on the remote Machine A, then attempted to ssh from Machine A to MyFW.
This works for a normal 'user':
$ ssh -L 9022:localhost:222 firstname.lastname@example.org $ ssh localhost -p 9022
As expected, the first command creates the tunnel. The 2nd command tunnels ssh to the CLI of the machine on the other end.
but this doesn't work for the restricted 'tunnel':
$ ssh -L 9222:localhost:222 email@example.com $ ssh localhost -p 9222
The CLI reports that the connection closes. There is nothing I can see in the syslog to show what the problem is.
Given that the tunnel user doesn't have a shell, should I expect a tunneled ssh to work?? As I write this I think maybe not. How should I test the tunnel?
What am I doing wrong??
Can someone please try this out and post a set of working instructions or errors in mine.
How can a tunnel with a restricted user be tested?
The user tunnel account was created without a password. This caused problems using ssh because the tunnel account was reported locked.
It seems that creating an account without a password, in an attempt to stop password hacking (can't hack a password if it doesn't exist), is a bad idea and weakens security.