SSH user without any rights on a server

[PleegWat]

On 06/24/2011 02:01 AM, Frank wrote:
> The idea behind all that is to allow "reverseuser" from PC A to login to
> the server only to set up the reverse ssh connection and nothing else.
> The server accepts the login request, the ssh link is established. As
> soon as the "reverseuser" presses any key, the connection will be lost.
> And that's OK ! :-)
> Apparently, "reverseuser" is not able to list files, browse folders,
> rsync or scp files from the server.
> In other words, "reverseuser" can do nothing on the server, except
> establish a reverse ssh connection.

I suspect that reverseuser still has full access to the internet, since 
tunnels can be opened in either direction. This means an attacker who 
gained access to that account could, for example,

   - Use it as an intermediate for members of a botnet to contact him
   - Use it as an intermediate to contact his botnet
   - Use it to directly attack various foreign hosts, for example to 
execute port scans or send spam email. The foreign hosts would assume 
your server (and hence you) areresponsible for these attacks.

Likely some form of firewalling can be used to reduce the risks here. 
Also, as has been stated by Avi, security can be improved by giving each 
of your friends their own accounts with strong passwords to be used for 
this purpose.

PleegWat