7

I've been trying to setup a VPN SSH tunnel and I've had success executing

ssh -Nv -w 0:0 root@192.168.2.2 -p 50

However, what I am wondering is, can I do the tunneling without having root unlocked?

When I try

ssh -Nv -w 0:0 $username@192.168.2.2 -p 50

and have root account disabled while $username is set in sudoers, I get an administratively prohibited.

So my question is, can I do the tunnel without having root enabled?

wogsland
  • 199
  • 1
  • 4
  • 12
mayotic
  • 197
  • 1
  • 1
  • 6
  • 2
    +1 I like the question, I have the same intentions (vpn tunnel) and I assume having root login enabled cannot be a good solution in the long run, can it? – humanityANDpeace Mar 29 '13 at 06:50

2 Answers2

3

Normally on most distributions of Linux you can't bind to ports lower than 1024 without privileges.

It may however be that what you want to do can be achieved a different way. For example, if you are a web developer trying to work remotely you may want to use a Dynamic tunnel in Putty as a SOCKs proxy to have your browser requests come out at the destination server's end. Also any local port forwarding done with an SSH tunnel is reliant on permissions at the connecting user's end, not the server end. The only time permissions becomes an issue is when doing a Remote tunnel.

If you want to fully VPN over SSH, some customisation will be required at both ends. See this guide for quite a thorough walk through. That guide describes the process with a Linux remote user connecting to a Linux server. The process is not as simple (I don't even know how you'd do it nicely!) if the remote user is running Windows.

haggai_e
  • 272
  • 1
  • 7
SimonJGreen
  • 3,205
  • 5
  • 33
  • 55
  • yea i found that article along with another and they were quite helpful and thank you for clarifying the ports privileges :D – mayotic Jan 09 '12 at 17:08
  • 2
    @SimonJGreen You mention that non-root users can bind to ports <1024. Would this mean, that this is the reason why ssh-vpn would not work? And if so, is there a reason to use a port <1024 why not using any port in 1024 - 65000 ? – humanityANDpeace Mar 29 '13 at 06:48
  • The question doesn't even mention ports, where did you get that from? – Ken Sharp Aug 17 '22 at 15:59
1

A variation of that question would be: Can you lock down an ssh VPN over the root account so that the tun* devices can be setup but nothing else can be done? (shell, file transfer, port fwd, etc.)

This list of security options for sshd, etc may help figure this out: https://askubuntu.com/questions/48129/how-to-create-a-restricted-ssh-user-for-port-forwarding

Community
  • 1
Alex
  • 11
  • 2