Providing SSH tunnling, what to think about when configuring Ubuntu Server

Question

Recently I've considered, mostly as a pet project, to set up accounts for a closed group of users via SSH to my box with the purpose of SSH tunnling things like web traffic -- some of it for friends that live abroad and perhaps also to help some people bypass national censorship. There's some things I imagine that I need to do, such as:

• Disabling shell access by setting the shell to /bin/false or similar.
• Get some software that can track bandwidth usage on a per-user basis historically
• Make sure that each user can only use a certain amount of bandwidth.

The reason I'm posting here to begin with is to look around and get some pointers regarding what kind of things I should read up on, as well as hearing if there are any software recommendations for doing what I'm trying to do. I already know a bit since I've actually gotten SSH tunnling up and running already, I just don't feel like letting it loose to other people without restrictions and some basic monitoring.

I'm primarily trying to learn here, so if you think this is a Very Bad Idea (or if you have a better idea on how to do this) then by all means say so, but please include some information on how to do it :)

(I'm also open to trying things like OpenVPN but it seems really hard to set up, also I've heard SSH more often works in locked down environments)

Answer 1

Start by setting up required key authentication and disable use of passwords in sshd. The most common attack on Internet attached ssh daemons are password brute force attacks. The simplest way to counter such an attack is disabling passwords for sshd.

Check your /etc/ssh/sshd_config for the following settings:

PermitRootLogin no
PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no

Don't forget to restart sshd: /etc/init.d/ssh restart.

When fiddling with sshd_config from a remote machine, make sure you have an extra session logged in, just in case you made a typo you can still access the server.

Also the advantage of /usr/sbin/nologin instead of /bin/false is that you actually get a short message as user that logging on to a shell environment is not permitted. Unsure if you can still set up tunnels. BTW the documentation for OpenVPN2 is pretty good and if you can run through firewalls, you can probably run OpenVPN2 too.

Check out this sslh project which allows you to run a common webserver and ssh (or openvpn for that matter) on the same port! http://www.rutschle.net/tech/sslh That way you can 'hide' your ssh server behind a proper webserver ;o)

Last but not least: Check out proxytunnel, which enables you to run SSH over HTTPS which fools even more firewalls.

Notice though that a security officer may very well be extremely un-amused when he/she finds out that you are using these tools (ssh over port 80 or 443, proxytunnel, openvpn) to squeeze through a corporate firewall to access unsupported services. In many companies you can get fired for that.