3

My understanding is when creating an ssh tunnel to a remote machine, the ports become open on that machine for anyone to use and connect back to my local box (not just the user who opened the tunnel). Is there a way to restrict access to the ports opened on the remote machine to a specified unix group? I was thinking this may be possible via an iptables rule or some other TCP/IP port restriction but I am not entirely sure.

Thanks

1 Answer 1

3

You can use the iptables owner module to match the UID or GID of the originating socket, but this only works for packets originating locally (i.e. from the remote machine).

% ssh -fNR 20022:localhost:22 localhost
% sudo iptables --append OUTPUT --destination 127.0.0.1 --protocol tcp --dport 20022 --match owner \! --uid-owner mgorven --jump REJECT
% sudo iptables -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 40 packets, 6349 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            127.0.0.1            tcp dpt:20022 ! owner UID match 1000 reject-with icmp-port-unreachable
% telnet 127.0.0.1 20022
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
^]
telnet> Connection closed.
% sudo telnet 127.0.0.1 20022
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
1
  • That may work fine, as I am trying to prevent random users on the remote machine to access the ports I have opened locally. Jun 12, 2012 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .