Tunnel-only user for SSH on NixOS

I really enjoy reading Solène’s website and I stumbled upon one of her posts again while reading more about SSH tunneling. In this post, she talks about setting up dedicated user for ssh tunneling only on OpenBSD1. Of course, as a Nix user I have to show you how easy it is to do the same on NixOS.

Generating ssh keys

Well, this process is the same for NixOS. You use ssh-keygen just as usual, but in this case I will generate a ed25519 key:

$ ssh-keygen -t ed25519

Adding a user

This is the fun part, NixOS provides a set of modules to configure users to configure users in a declarative manner. Let’s leverage it to create a user that has no shell access nor a home:

users.groups.tunnel = { };
users.users.tunnel = {
  group = "tunnel";
  isSystemUser = true;
  shell = "${pkgs.shadow}/bin/nologin";
  createHome = false;
  openssh.authorizedKeys.keys = [ "<your-ssh-key>" ];

Connect using SSH

Again, this is the same for a NixOS and a Non-NixOS system. The key part here is the required -N flag:

$ ssh -N -L 10000:localhost:993 tunnel@host

  1. I need to try OpenBSD sometime in the future, by the way. ↩︎

Articles from blogs I follow around the net

Variations of the Range kata

In the languages I usually employ. The Range kata is succinct, bordering on the spartan in both description and requirements. To be honest, it's hardly the most inspiring kata available, and yet it may help showcase a few in…

via ploeh blog January 1, 2024

Some notes on NixOS

Hello! Over the holidays I decided it might be fun to run NixOS on one of my servers, as part of my continuing experiments with Nix. My motivation for this was that previously I was using Ansible to provision the server, but then I’d ad hoc installed a bunch…

via Julia Evans January 1, 2024

I found some of my first code! Annotating and reflecting on robotics code from 2009.

In high school, one of my teachers shattered my plans for my life, in the most beautiful way. Most of my life, I'd intended to become a math professional of some sort: a math teacher, when that was all I saw math for; an actuary, when I started to lear…

via ntietz.com blog January 1, 2024

Generated by openring