Hacker News Reader

Comment by inigyou | Hacker News Reader

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git.

This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.

View on HN

I suppose /usr/sbin/nologin is not a thing?

https://www.man7.org/linux/man-pages/man8/nologin.8.html

That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits.

It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.

Do you have a script to show us how it works? Here, use Claude's login [1]. There's no password. I am not very technical so let me know if I should set a password on that account. I trust everyone here.

    [1] - sftp ai@nochan.net

Doesn't seem to allow port forwarding so I think you're probably good.

git-shell is actually made for this exact situation. it does allow uploading git repos I think so you can't open it to the public, maybe there's a way to configure it though to not allow that.

SSH bastions would like a word I guess. You can authenticate, but you definitely can’t login (which is also the case for git over SSH).

An SSH bastion host allows to request direct-tcpip channels, but is going to restrict other channel types, like pty requests, shell requests, exec requests or other subsystems.

The "login permission" term is confusing because it's likely supposed to mean "shell requests", but SSH channel requests in general are all post auth, which could also be considered a "login". In OpenSSH you still need to explicitly configure permitted channel requests, which I think is what GP is referring to.

For git specifically I would recommend the ForceCommand feature in OpenSSH, all exec requests are then forwarded to this program, with $SSH_ORIGINAL_COMMAND set to the original command. You may then use an allow-list of commands you want to permit.

Reply on news.ycombinator.com