Ssh – How to prevent SSH connection be closed by server for a user with nologin shell

ssh

Basic info:
Server OS: CentOS 6.3
Client tool: PuTTY

I SSH to my server using PuTTY.
I added an account with /sbin/nologin shell. When I log on to that account (selecting "never" close window on exit), console says "This account is currently not available" and PuTTY prompts "Connection closed by remote host".

But I expect the server should only say "account not available" without closing the connection, so that I can still tunneling through this connection.

I also noticed that for normal /bin/bash users, when typing exit, sometimes the connection is closed, sometimes the server says "LOGOUT" but still connected (I can still tunneling through it).

So how can I ensure a connection not to be closed for a nologin shell account?

Best Answer

An account with /usr/sbin/nologin as its shell is permitted to set establish port forwarding. However, if you attempt to run a shell command, the connection is forcibly terminated. The fix is to not run a shell command. With OpenSSH (the SSH implementation on almost all non-embedded Unix/Linux systems), pass the option -N to the SSH client.

ssh -N -L 1234:somehost:5678 restricteduser@host.example.com

With PuTTY, tick “Don't start a shell or command at all” in the Connection > SSH tab.

Related Solutions

SSH HTTP Tunnelling

The PermitOpen accepts any when its the only argument. Meaning it accepts PermitOpen any.
The only way I can think of to do this would be to use an iptables rule.

iptables -I OUTPUT -p tcp ! --dport 80 -m owner --uid-owner 1000 -j REJECT

This would reject any outbound traffic from user with UID=1000 that isn't going to port 80

Ssh – Is it safe to use /bin/cat as shell for a restricted user

This is a pretty standard reason to change the shell. Typically /bin/false or other shells like /bin/cat are used.

Typically you can't escape from /bin/cat and it is unlikely that cat has a security bug but other methods may still work, like creating a DoS or bypassing Firewall rules.

Another probably more severe problem is if you are using the internal-sftp module for sftp. This would allow users with /bin/cat as shell to use sftp to get access to your file-system and browse its content.

For your specific use-case i would recommend using tunnels or vpns instead of providing ssh access to your customers.

Best Answer

Related Solutions

SSH HTTP Tunnelling

Ssh – Is it safe to use /bin/cat as shell for a restricted user

Related Question