I have enabled the SSH Server on Windows using the built-in feature. Since this server is only being used as a tunnel, I would like to disable any commands from being executed.
On linux, it appears to be possible to set the shell to /sbin/nologin. What would be the equivalent on a windows machine?
You can specify the shell executable to use in the Windows version via registry (documentation). E.g. you can set powershell as default shell as follows:
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force
However I am not aware of any nologin shell alternative in Windows. As for a quick and dirty workaround, I have set a windows32 executable (sfc.exe) as "shell" using the method above.
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\sfc.exe" -PropertyType String -Force
In this way, clients can connect only with the -N switch, or else the connection closes immediately. Note that the ssh user must not be an administrator, so it cannot actually run sfc.exe. (Maybe there is a better choice for dummy shell than sfc.exe :P)
