Question restricting ssh access for some users only

From: Jim Hatfield (subscriber_at_insignia.com)
Date: 10/07/04

  • Next message: Volker Kindermann: "Re: Question restricting ssh access for some users only" 
    To: freebsd-security@freebsd.org
Date: Thu, 07 Oct 2004 18:29:35 +0100

    I've used ssh as a secure telnet up to now but done little else with
    it. The FreeBSD machines I look after on our internet-facing network
    all have one account which I connect to for administration. I've set
    up /etc/hosts.allow on all the machines to only allow ssh from a
    limited internal network range.

    Now I want to create a new account on one machine which will be
    accessible from the Internet as a whole, to be used for tunnelling of
    SMTP and POP3. I can't predict what the client IP address will be so I
    will have to remove the hosts.allow restriction. Is there any way I
    can:

    - still prevent connections to my admin user from anywhere except a
      restricted set of addresses

    - disallow shell access for the new account but still allow tunnelling

    I think I can solve the first problem by using a new login class and
    an entry in login.conf, but there may be better ways.

    I think I can solve the second by giving the new user a shell of
    /bin/cat (putting that in /etc/shells) but again there may be a neater
    way.

    jim
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Volker Kindermann: "Re: Question restricting ssh access for some users only"

    Relevant Pages

    • Re: rdist question
      ... > other than an SSH one would be better to ask, ... > Depends on your infrastructure. ... > Assuming I had scriptable ssh root access to all the target machines, ... There's lots of ways to do this wrong and hose your account ...
      (comp.security.ssh)
    • Re: rdist question
      ... other than an SSH one would be better to ask, ... Depends on your infrastructure. ... Assuming I had scriptable ssh root access to all the target machines, ... There's lots of ways to do this wrong and hose your account ...
      (comp.security.ssh)
    • Re: Can Exceed connect to linux (running Gnome) through SSH?
      ... > -These machines are in two separate physical locations and separated ... Each firewall allows SSH ... Now start xterm and you should see a window pop up" ... > I simply log in through the Gnome login screen and it works. ...
      (comp.os.linux.security)
    • (no subject)
      ... > -These machines are in two separate physical locations and separated ... Each firewall allows SSH ... Now start xterm and you should see a window pop up" ... > I simply log in through the Gnome login screen and it works. ...
      (comp.os.linux.security)
    • Re: Did I give up on telnet too easily?
      ... > If ssh is to be considered 'more secure' than telnet, ... have a mixture of Debian, Red Hat, Trustix, Tru64 Unix, and HP-UX machines. ... theirs isn't OpenSSH based, so it wouldn't have needed updating). ... > etc.) I think a better approach would be to use telnet for remote access. ...
      (comp.os.linux.networking)