Hacker News Reader

Comment by epimenov | Hacker News Reader

I have a key generated for AutoSSH only.

Also you can limit to which hosts/ports it can connect with:

     no-agent-forwarding,no-X11-forwarding,command="read a; exit",permitopen="host:port" ssh-ed25519 AAAA

Pretty nifty.

View on HN

I've gone so far as to create a separate autossh user with separate key, with no shell access (by setting the user's shell to /bin/false). It still permits tunneling (call ssh with -N), but does not allow shell sessions. Perfect for when you want to access remote systems via a remote tunnel but do not want to give shell access on the relaying machine to the tunnel origin. It trusts that the machine originating the tunnel will not initiate a reflection attack (by making a local forward to the remote port itself on the originating machine and causing some log messages to appear until all file descriptors are in use)[1], but that's not so unreasonable.

1. http://www.semicomplete.com/articles/ssh-security/

Same here actually, the user has /bin/false as shell.

On the server side, right?

Yes, in the authorized_keys

Reply on news.ycombinator.com