Single-Purpose SSH account, exclusively for Reverse Port Forwarding

Posted by drfloob on Server Fault See other posts from Server Fault or by drfloob
Published on 2010-04-02T23:20:34Z Indexed on 2010/04/02 23:23 UTC
Read the original article Hit count: 511

Filed under:

ssh

|

port-forwarding

|

user-management

On my Debian system, I'd like to create a user that is only allowed to do a Reverse Port Forward from their machine to my server, but I'm not sure how to create a limited user specifically for this purpose.

For example, we'll call my server 'Sam' and my laptop 'Luke'. I'd like a user on Luke to be able to execute a reverse port forward ssh command to Sam, so that port 4321 on Sam is tunneled to port 4321 on Luke. For example:

ssh -fnR 4321:localhost:4321 -l limitedUser Sam

How can I create a user on Sam that is only allowed to execute this command?

© Server Fault or respective owner

Related posts about ssh

Problem with hadoop start-dfs.sh

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I installed and configured hadoop on my Ubuntu 14.04 server, virtualized inside of hyper-v, however I am getting an issue when i run start-dfs.sh root@sUbuntu01:/var/log# start-dfs.sh 14/06/04 15:27:08 WARN util.NativeCodeLoader: Unable to load native-hadoop library for your platform... using builtin-java… >>> More
SSH problems (ssh_exchange_identification: read: Connection reset by peer)

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I was running 11.10 and decided to do the full upgrade and come up to 12.04 after the update SSH (not SSHD) is now misbehaving when attempting to connect to other OpenSSH instances. I say OpenSSH as I am running a DropBear sshd on my router and I am able to connect to it. When attempting to connect… >>> More
SSH main process ended

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have a running ubuntu server 10.04.1. When I tried to login to the server via ssh, I could not. Instead, I got connection refused error. I tried to ping the machine and I got reply! So, the clear reason is that SSH daemon is stopped. After reboot, I was able to login to my server via ssh. After… >>> More
SSH server not working (respawns until stopped)

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have a running Ubuntu Server 10.04.1. When I tried to login to the server via ssh, I could not. Instead, I got connection refused error. I tried to ping the machine and I got reply! So, the clear reason is that SSH daemon is stopped. After reboot, I was able to login to my server via ssh. After… >>> More
Cannot SSH after resetting firewall on VPS

as seen on Server Fault - Search for 'Server Fault'
I'm having trouble trying to SSH to my Debian 5 VPS with blacknight. It was working fine until I did the following: Logged into 'Parallels Infrastructure Manager' - Container - Firewall - Set to 'Normal Firewall settings'. It told me there was an error with the IPTables and offered the option again… >>> More

Related posts about port-forwarding

Stable reverse port forwarding in SSH and stale sessions

as seen on Super User - Search for 'Super User'
Using VPS to forward ports behind NAT: for((;;)) { ssh -R 2222:127.0.0.1:22 [email protected]; sleep 10; } When connection is broken somehow and it is reconnecting. Warning: remote port forwarding failed for listen port 2222 Linux vi-server.no-ip.org 2.6.18-92.1.13.el5.028stab059.3 #1 SMP Wed Oct… >>> More
port forwarding? [closed]

as seen on Super User - Search for 'Super User'
Possible Duplicate: Configure Modem for Bittorrent downloads any guides on portforwarding? I want to speed up my torrent downloads >>> More
WRT54G - how use port forwarding and VNC

as seen on Super User - Search for 'Super User'
Since I have my home network behind a WRT54G, the router has an external "real" IP address, and the PCs behind it have 192.168.xxx.xxx addresses. I would like to be able to control one of them remotely - preferably using UltraVNC, but I am open to suggestions. Since I can't directly address that… >>> More
Port forwarding - firewall deactivated?

as seen on Super User - Search for 'Super User'
In a Port Forwarding guide I have read I should set port forwarding on my ADSL modem and disable its firewall. Until I did both of this, my torrent client was not visible as a server from outside. However, I am unsure what implications disabling firewall has and why it is needed. Can anyone explain… >>> More
PortForwarding to IIS in Linux

as seen on Server Fault - Search for 'Server Fault'
Hi, I am trying to set up port forwarding on a linux box to a IIS webserver on my internal network. The web server sits on Windows 2003 Server. My linux box has eth0 - Internet connection eth1 - internal subnet (10.10.10.x) eth2 - 2nd internal subnet (129.168.0.x) dhcp interface my webserver… >>> More