openssh unix dev - Mar 2017 - ssh man page about 'tunnel' feature

"Hi,

I was reading about the tunnel/VPN feature and found this section of
the ssh man page:
http://www.gsp.com/cgi-bin/man.cgi?section=1&topic=ssh#8
under "SSH-BASED VIRTUAL PRIVATE NETWORKS"

--
Client access may be more finely tuned via the
/root/.ssh/authorized_keys file (see below) and the PermitRootLogin
server option. The following entry would permit connections on tun(4)
device 1 from user "jane" and on tun device 2 from user
"john", if
PermitRootLogin is set to "forced-commands-only":

tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john
--

Is that true? Can /root authorized_keys set keys for other users? I
can't find a reference to this in other man pages, or the source code.

Catalin

Catalin Patulea wrote:
> The following entry would permit connections on tun(4)
> device 1 from user "jane" and on tun device 2 from user
"john",
> if PermitRootLogin is set to "forced-commands-only":
> 
> tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ...
jane
> tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ...
john
> --
> 
> Is that true?
Yes.
> Can /root authorized_keys set keys for other users?
jane and john are not neccessarily local users, they are usernames
in the comment fields of the two authorized public keys.

The comment by default reflects the current username on the system
where a key was generated.

If that happened to have been on the local system, then local users
jane and john are indeed authorized to create tunnels, but that use
case doesn't make much sense.


//Peter