Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I understand this is used to prevent users from using the server as a proxy. But if the users can use curl/wget, doesn't that mean it's essentially bypassable?

The manual page regarding SSH also said the same thing, but it wasn't very specific as to how this was doable.

share|improve this question

2 Answers 2

My experience is that you only use this option in conjunction with a restricted shell like you might set with command= in the authorized_keys. It isn't very useful when you grant the user full shell access.

If you had shell access one method from the bygone days would be to use a tool like slirp which would basically emulate give you a PPP connection to the box.

I am not sure of the specific methods using curl/wget, but I would not be surprised about them at all. Though I think it would be a lot easier to bypass if netcat was on the remote system.

share|improve this answer

If you allow remote execution of content via SSH, you can then fire off curl/wget and pipe the throughput through the secure connection. Since this isn't a TCP forward, it's a TCP connection triggering an application execution which triggers another TCP connection (or series thereof) and then return data over the original TCP connection. It takes a tour through Layer 7 there. It's a lot more clunky to do it that way, but it can be done.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.