From owner-freebsd-security@FreeBSD.ORG  Thu Sep 22 16:22:41 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id DDB8816A41F
	for <freebsd-security@freebsd.org>;
	Thu, 22 Sep 2005 16:22:41 +0000 (GMT)
	(envelope-from david@catwhisker.org)
Received: from bunrab.catwhisker.org
	(adsl-63-193-123-122.dsl.snfc21.pacbell.net [63.193.123.122])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 9081343D45
	for <freebsd-security@freebsd.org>;
	Thu, 22 Sep 2005 16:22:39 +0000 (GMT)
	(envelope-from david@catwhisker.org)
Received: from bunrab.catwhisker.org (localhost [127.0.0.1])
	by bunrab.catwhisker.org (8.13.3/8.13.3) with ESMTP id j8MGMc3f089370
	for <freebsd-security@freebsd.org>;
	Thu, 22 Sep 2005 09:22:38 -0700 (PDT)
	(envelope-from david@bunrab.catwhisker.org)
Received: (from david@localhost)
	by bunrab.catwhisker.org (8.13.3/8.13.1/Submit) id j8MGMcXI089369
	for freebsd-security@freebsd.org; Thu, 22 Sep 2005 09:22:38 -0700 (PDT)
	(envelope-from david)
Date: Thu, 22 Sep 2005 09:22:38 -0700
From: David Wolfskill <david@catwhisker.org>
To: freebsd-security@freebsd.org
Message-ID: <20050922162238.GZ54033@bunrab.catwhisker.org>
Mail-Followup-To: David Wolfskill <david@bunrab.catwhisker.org>,
	freebsd-security@freebsd.org
References: <20050922152718.GB91509@logik.internal.network>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050922152718.GB91509@logik.internal.network>
User-Agent: Mutt/1.4.2.1i
Subject: Re: Tunnel-only SSH keys
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 22 Sep 2005 16:22:42 -0000

On Thu, Sep 22, 2005 at 04:27:18PM +0100, markzero wrote:
> Hello.
> 
> I once read somewhere that it's possible to limit SSH pubkeys to
> 'tunnel-only'. I can't seem to find any information about this
> in any of the usual places.
> ...
> Can this be done with OpenSSH? I'd like to try and stay away from
> the complexities of a chrooted-stunnel for now...

See the section "AUTHORIZED_KEYS FILE FORMAT" in the sshd man page.

There is also a discussion of this in the O'Reilly _SSH_ book.

Peace,
david
-- 
David H. Wolfskill				david@catwhisker.org
Prediction is difficult, especially if it involves the future. -- Niels Bohr

See http://www.catwhisker.org/~david/publickey.gpg for public key.