From owner-freebsd-security@FreeBSD.ORG  Thu Oct  7 17:29:38 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1253516A4CE
	for <freebsd-security@freebsd.org>;
	Thu,  7 Oct 2004 17:29:38 +0000 (GMT)
Received: from highland.isltd.insignia.com (highland.isltd.insignia.com
	[195.74.141.1])	by mx1.FreeBSD.org (Postfix) with ESMTP id 822CD43D31
	for <freebsd-security@freebsd.org>;
	Thu,  7 Oct 2004 17:29:37 +0000 (GMT)
	(envelope-from subscriber@insignia.com)
Received: from dailuaine.isltd.insignia.com (dailuaine.isltd.insignia.com
	[172.16.64.11])i97HTae3013733	for <freebsd-security@freebsd.org>;
	Thu, 7 Oct 2004 18:29:36 +0100 (BST)
	(envelope-from subscriber@insignia.com)
Received: from speyburn.isltd.insignia.com (speyburn [172.16.64.16])
	i97HTZgF006449	for <freebsd-security@freebsd.org>;
	Thu, 7 Oct 2004 18:29:35 +0100 (BST)
	(envelope-from subscriber@insignia.com)
From: Jim Hatfield <subscriber@insignia.com>
To: freebsd-security@freebsd.org
Date: Thu, 07 Oct 2004 18:29:35 +0100
Organization: Insignia Solutions
Message-ID: <cvuam0t1l2u7npnigk6oqrlq288hlu0mgn@4ax.com>
X-Mailer: Forte Agent 2.0/32.640
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Scanned-By: MIMEDefang 2.44
Subject: Question restricting ssh access for some users only
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Oct 2004 17:29:38 -0000

I've used ssh as a secure telnet up to now but done little else with
it. The FreeBSD machines I look after on our internet-facing network
all have one account which I connect to for administration. I've set
up /etc/hosts.allow on all the machines to only allow ssh from a
limited internal network range.

Now I want to create a new account on one machine which will be
accessible from the Internet as a whole, to be used for tunnelling of
SMTP and POP3. I can't predict what the client IP address will be so I
will have to remove the hosts.allow restriction. Is there any way I
can:

- still prevent connections to my admin user from anywhere except a
  restricted set of addresses

- disallow shell access for the new account but still allow tunnelling

I think I can solve the first problem by using a new login class and
an entry in login.conf, but there may be better ways.

I think I can solve the second by giving the new user a shell of
/bin/cat (putting that in /etc/shells) but again there may be a neater
way.

jim