Question

So I have been working on this for some time. Would like to know if there is a better way or if I am on the right track.

I would basically like to allow some users to login to my server via SSH and then have a squid tunnel via that SSH connection.

The tricky part however is that I dont want these users to be able to execute ANY commands. I mean NOTHING at all.

So at this stage I have setup a Jail via – jailkit. The specific user is then placed in the jail and given the bash shell as a shell.

The next step would be to remove all the commands in the /jail/bin/ directories etc so that they are not able to execute any commands.

Am I on the right path here? What would you suggest?

Also…I see that it will give them many command not found errors…how do I remove these.

Is there any other shell I could look at giving them that would not let them do anything?

Answer 1

You could set their shell to something like /bin/true, or maybe a simple script that will output an informational message, and then have them logon using ssh -N (see the ssh manual page). I believe that allows them to use portforwarding without having an actuall shell on the system.

EDIT:

The equivalent of ssh -N in PuTTY is checking the “Don’t start a shell or command at all” checkbox in its SSH configuration tab (Connection->SSH).

EDIT2:

As an alternative to this you could use a script that enters an infinite sleep loop. Until it is interrupted using Ctrl-C the connection will remain alive. I just tried this:

#!/bin/sh

echo "DNSH: Do-Nothing Shell"

while sleep 3600; do :; done

If you use this as a shell (preferrably with a more helpful message) your users will be able to use port-forwarding without an actual shell and without having to know about ssh -N and friends.