up vote 6 down vote favorite
share [g+] share [fb]

I need to setup SSH to block all access to a certain IP on port 555. Only a small group of users should be allowed to tunnel to that IP. Currently I have the following stuff in my sshd_config

Match User bob
        PermitOpen 1.2.3.4:555 5.6.7.8:555

The question I have is, how do I deny all other users access to this tunnel? I dont see a denyopen, or restrictopen thing in sshd_config.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 6 down vote accepted

You could do it with a firewall on the SSH box:

iptables -A OUTPUT -p tcp -d 1.2.3.4 --dport 555 -m owner --uid-owner bob -j ACCEPT
iptables -A OUTPUT -p tcp -d 1.2.3.4 --dport 555                          -j REJECT
link|improve this answer
Just tested it out, works!. Thanks! – Pratik Amin Mar 15 '11 at 19:58
+1 This is even better than the SSH solution which was restricting SSH only, and not programs executed through SSH. – Lekensteyn Mar 15 '11 at 20:37
feedback
up vote 5 down vote

Disable TcpForwarding for all users by default:

AllowTcpForwarding No

And make an exception for user bob:

Match User bob
        AllowTcpForwarding Yes
        PermitOpen 1.2.3.4:555 5.6.7.8:555
link|improve this answer
I think the OP wants to allow tunneling to anywhere other than those. – geekosaur Mar 15 '11 at 18:54
From man sshd_config: "PermitOpen: Specifies the destinations to which TCP port forwarding is permitted. [..] An argument of "any" can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted.", this is my interpretation of his question. – Lekensteyn Mar 15 '11 at 18:58
Right, but my interpretation is the OP wants PermitOpen !1.2.3.4:555 by default, not AlloqTCPForwarding off. Guess we wait for clarification. – geekosaur Mar 15 '11 at 19:05
Sorry, so what I want is: All users to be able to tunnel everywhere EXCEPT for 1.2.3.4.5:555. Only certain users should be allowed to tunnel there. The problem with this solution is that if I then do Match User {enter all users here} AllowTCPForwarding Yes They will have access to that IP as well. That being said its still a very good answer :) It might very well need firewall rules on the otherside. – Pratik Amin Mar 15 '11 at 19:11
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.