From owner-freebsd-security@FreeBSD.ORG Thu Sep 22 18:01:10 2005 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 353DE16A41F for ; Thu, 22 Sep 2005 18:01:10 +0000 (GMT) (envelope-from reichert@numachi.com) Received: from meisai.numachi.com (meisai.numachi.com [198.175.254.6]) by mx1.FreeBSD.org (Postfix) with SMTP id 749EB43D45 for ; Thu, 22 Sep 2005 18:01:09 +0000 (GMT) (envelope-from reichert@numachi.com) Received: (qmail 79448 invoked from network); 22 Sep 2005 18:01:05 -0000 Received: from natto.numachi.com (198.175.254.216) by meisai.numachi.com with SMTP; 22 Sep 2005 18:01:05 -0000 Received: (qmail 43100 invoked by uid 1001); 22 Sep 2005 18:01:08 -0000 Date: Thu, 22 Sep 2005 14:01:08 -0400 From: Brian Reichert To: Jeremie Le Hen Message-ID: <20050922180108.GJ74605@numachi.com> References: <20050922152718.GB91509@logik.internal.network> <20050922160959.GQ24643@obiwan.tataz.chchile.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050922160959.GQ24643@obiwan.tataz.chchile.org> User-Agent: Mutt/1.5.9i Cc: freebsd-security@freebsd.org, markzero Subject: Re: Tunnel-only SSH keys X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Sep 2005 18:01:10 -0000 On Thu, Sep 22, 2005 at 06:09:59PM +0200, Jeremie Le Hen wrote: > Hi, > > > I once read somewhere that it's possible to limit SSH pubkeys to > > 'tunnel-only'. I can't seem to find any information about this > > in any of the usual places. > > > > I'm going to be deploying a few servers in a couple of days and > > I'd like them to log to a central server over an SSH tunnel (using > > syslog-ng) however I'd like to prevent actual logins (hence > > 'tunnel-only'). > > > > Can this be done with OpenSSH? I'd like to try and stay away from > > the complexities of a chrooted-stunnel for now... > > I think you can use /bin/false as shell, and then use ``ssh -nN'' > from the client. I've not tested this, but I guess this should > work. See this discussion: http://www.blacksheepnetworks.com/security/hack/scponly.txt > Regards, > -- > Jeremie Le Hen > < jeremie at le-hen dot org >< ttz at chchile dot org > -- Brian Reichert 55 Crystal Ave. #286 Daytime number: (603) 434-6842 Derry NH 03038-1725 USA BSD admin/developer at large