5
3
Suppose I have created an account whose login shell is actually a script which does not permit an interactive login, and only allows a very limited, specific set of commands to be remotely executed.
Nevertheless, ssh
allows the user of this account to forward ports, which is a hole.
Now, the twist is that I actually want that account to set up a specific port forwarding configuration when the ssh
session is established. But it must be impossible configure arbitrary port forwarding.
(It is an acceptable solution if the permitted port forwarding configuration is unconditionally established as part of the every session.)
If nobody comes forward in a couple of days, I will accept my own answer. And perhaps get working on it. – Kaz – 2012-12-07T22:09:20.833
If you keep it unaccepted/open for some time then you will receive little more attention. Some people like spending weekend at somewhere else than SO :)
– Sampo Sarrala - codidact.org – 2012-12-07T22:34:22.230My original answer was a proposed patch, but existing features in OpenSSH do the job. – Kaz – 2012-12-08T00:16:02.863
Oops, this belongs on serverfault, doesn't it! It's easy to forget that "superuser" here doesn't mean "root" or "sysadmin". – Kaz – 2012-12-08T00:30:28.303