I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet.
I also have a number of "remote servers" and "IoT devices" (O: Others) that I trust a bit less (because they are outside in the world, physically accessible to other people than me). "In theory", they are safe (for example, at the home of a family member), but still I trust these a bit less.
I want to be able to SSH to the "O" devices from the internet. I do not want to set router port forwarding at the location of the "O" devices, this would be too much hazzle. So, the solution I consider is to set up a reverse ssh tunnel for each "O" device that forwards connections from some port of "M" to port 22 on the corresponding "O" device.
For this, I have to set up SSH keys on the "O" devices, to connect to some account on "M" to perform the ssh -R
command. To enable automatic reboot in case of a problem, this SSH key needs to be usable by "O" out of the box, without me to enter any passphrase, ie the SSH must be available fully decrypted on "O". So, I cannot really fully trust the "O" keys (they may get stolen or else), when used to log onto "M", and I do not want people having access of these keys to be able to do anything on the "M" machine else than ssh port forwarding.
My question is, how to make this as well and secure as possible?
The solution I have found so far is to set up a very limited account on "M", that only allows to perform the port forwarding. For this, I:
- create the user (user_r) on "M", with user_r not being able to sudo
- set up a SSH key to log to user_r, and disable password ssh login for "M"
- change the default shell for "M" by editing
/etc/passwd
for user_r to/usr/sbin/nologin
From there on, it is possible to establish a SSH reverse tunnel that forward from "M" to "O", by running on "O":
ssh -NR M_PORT:localhost:22 user_r@M_IP_OR_DOMAIN
Dropping the N
, or trying to "ssh in a normal way", using user_r account on "M", just returns immediately and says that the account is disabled, but using -NR
still lets me set up the reverse tunnel.
My questions:
- is this secure?
- is there a way to make this even more secure?
- any flaws / possible improvements / better solution?