Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #226998

Re: Securing local host of reverse SSH tunnel?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

>Ideally, this restriction should be based on
the public key of the pair but I've not seen in sshd_config(5) a way for
the Match directive to use the public key as its trigger

Not an expert but did you look at the certificate based authentication? You
can define your own certificate authority and allow only the certificates
signed (it's a public key) by your ca can to connect to your ssh server.

1 - Generate a key pair for the ca ( and another for he remote user)

$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/ca -m PEM

2- Sign the public key of the user
ssh-keygen -s ca \
-I <user-name> \
-V 20191220:20201220 \
user_key.pub
<user-name> will be logged on your server everytime a connection is opened
with user_key.pub. -v stands for key validity.

3 - Allow on your LAN (ssh server)

TrustedUserCAKeys /secure/permission/ca.pub

This means, any certificate signed with this ca will be granted access to
your server. Of course you can restrict what the users whose login is
allowed (particularly prevent root login 😂).

Note: using the certificate based authentication, you can even choose what
kind of features are allowed to be used with a particular certificate. a
k.a AllowX11Forward and many more. Maybe a good reading of ssh doc may
provide you an better approach for your use case. ssh(1)

Hope this will help.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Securing local host of reverse SSH tunnel? Nate Bargmann <n0nb@n0nb.us> - 2020-09-15 14:00 +0200
  Re: Securing local host of reverse SSH tunnel? Dan Ritter <dsr@randomstring.org> - 2020-09-15 14:20 +0200
  Re: Securing local host of reverse SSH tunnel? echo test <echotest09@gmail.com> - 2020-09-15 14:40 +0200
  Re: Securing local host of reverse SSH tunnel? Fabrice BAUZAC-STEHLY <noon@mykolab.com> - 2020-09-15 21:00 +0200
    Re: Securing local host of reverse SSH tunnel? Alex Mestiashvili <amestia@rsh2.donotuse.de> - 2020-09-16 19:10 +0200
      Re: Securing local host of reverse SSH tunnel? Nate Bargmann <n0nb@n0nb.us> - 2020-09-17 01:30 +0200
        Re: Securing local host of reverse SSH tunnel? Alex Mestiashvili <amestia@rsh2.donotuse.de> - 2020-09-22 10:30 +0200
    Re: Securing local host of reverse SSH tunnel? Nate Bargmann <n0nb@n0nb.us> - 2020-09-17 20:40 +0200

csiph-web