12

I want to use SSH Tunneling on my local machines to bypass government restrictions. I'm talking about creating a socks proxy server using a ssh connection.

ssh -f -N -D 1080 [email protected]

This works perfectly right now. But I want to pass this to few other people (friends and family members). The thing is right now I'm using an admin user to do this. I thought I should probably just create a non-admin/guest user for each person.

I'm a bit worried if they decide to ssh normally and mess up with the server, or if they lose the login credentials or it gets into a hacker's hand.

That's I wanna take it one step further and just limit them to the point where they literally can't do anything or harmful, but with just enough functionality to run the ssh tunneling.

So what do I do after adduser <username>?

Improve this question
7
  • 2
    what about using vpn tunnels to connect to your machines? I would suggest using wireguard, ipsec or openvpn the create encrypted tunnels between your machines - a virtual private network. This way you do not need to give any ssh credentials to anyone. How to restrict ssh is something i cannot help you with, sorry. Perhaps when creating a user you could use useradd -s /bin/false but i do not know if this breaks your ability for tunnels.
    – AlexOnLinux
    Commented Sep 16, 2019 at 7:14
  • @AlexOnLinux the problem is that the gov has blocked most of the tunneling protocols. I used to have openvpn and shadowsocks but they got hit and now they won't work. that's why i'm looking for a super bulletproof method that is not ban-able so to speak. I did try to setup wireguard few days ago but i couldn't get it working. There weren't many documentation around so I was just doing trial and errors. Not sure if they've blocked wireguard or it's because my setup/config is wrong.
    – Hassan
    Commented Sep 16, 2019 at 8:47
  • 2
    wireguard is pretty easy to setup but i guess it will be banned either, if openvpn already is. I used this explanation to learn how to set it up github.com/adrianmihalko/raspberrypiwireguard To obfuscate you might be able to use something like stunnel perhaps. But since you have good reason to use ssh over these other vpn services, did you try -s /bin/balse to see if you are still able to use the tunnel without giving the user the ability to use a shell?
    – AlexOnLinux
    Commented Sep 16, 2019 at 9:30
  • @AlexOnLinux I just found out I can do ForceCommand echo 'This account is limited' in the sshd_config file and it prevents users from connecting to server while being able to do ssh tunneling. is that secure enough though? I tried to ChrootDirectory /var/chroot/ but it breaks the ssh tunneling. And no I haven't tried -s /bin/balse because I need the user to have a home directory so I can put their ssh keys in there ( ~/.ssh/authorized_keys )
    – Hassan
    Commented Sep 16, 2019 at 13:34
  • 3
    thx but it was you who found the answer, so it is up to you to answer you question for the public :)
    – AlexOnLinux
    Commented Sep 17, 2019 at 6:56

1 Answer 1

Reset to default
10

After some digging and the great hint from Alex I found a working solution.

You only have to add 2 parameters when creating a new user.

sudo adduser limiteduser --shell=/bin/false --no-create-home

--no-create-home will skip creating a home directory for the user, and --shell=/bin/false will make sure the user will never get a shell access, no matter if they're trying to login locally or connect remotely using ssh.

If you're paranoid like me you can also limit them in /etc/ssh/sshd_config like so:

Match user limiteduser
   ForceCommand /bin/false

Note: Don't try to chroot them, It doesn't work. At least not for me. When I tried to chroot them I got this error : channel 2: open failed: connect failed: Device or resource busy. Maybe I didn't setup my chroot enviroment correctly but I think the chroot is way too isolated for the tunneling to work.

Anyway the most important part is the ssh tunneling which works fine using the methods above.

ssh -N -D 1080 [email protected]

This connects successfully and establishes a tunnel between you and your server which you can use to route your traffic at port 1080. And it doesn't even require a shell access. In case the limiteduser decides to ssh normally, they get an error and ssh connection closes immediately.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .