Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to limit port forwarding with OpenSSH? I'd like to let users ssh -R on ports 6000..7000, but I'd like to block ssh -D and ssh -L.

share|improve this question
add comment

3 Answers 3

The configuration directives for sshd_config that you're interested in include:

AllowTcpForwarding
PermitOpen

There does not seem to be any granularity in regards to restricting the type of port forwarding allowed.

However, pay attention to the documentation for the AllowTCPForwarding option:

 AllowTcpForwarding
         Specifies whether TCP forwarding is permitted.  The default is
         ``yes''.  Note that disabling TCP forwarding does not improve
         security unless users are also denied shell access, as they can
         always install their own forwarders.

The concept being that if your users have shell access, it's trivial for them to setup their own forwarding once they are logged in using a utility such as netcat. This would circumvent any sshd configuration settings.

share|improve this answer
add comment

There's also the use of iptables which lets you have fined grained control over the ports that are allowed to be connected and/or forwarded.

share|improve this answer
add comment

http://www.manpagez.com/man/8/sshd/ Search for PermitOpen

I do:

Match User Blah
PermitOpen BlahComputer:3389

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.