SSH option AllowTcpForwarding is bypassable?

Question

I understand this is used to prevent users from using the server as a proxy. But if the users can use curl/wget, doesn't that mean it's essentially bypassable?

The manual page regarding SSH also said the same thing, but it wasn't very specific as to how this was doable.

Answer 1

My experience is that you only use this option in conjunction with a restricted shell like you might set with command= in the authorized_keys. It isn't very useful when you grant the user full shell access.

If you had shell access one method from the bygone days would be to use a tool like slirp which would basically emulate give you a PPP connection to the box.

I am not sure of the specific methods using curl/wget, but I would not be surprised about them at all. Though I think it would be a lot easier to bypass if netcat was on the remote system.

Answer 2

If you allow remote execution of content via SSH, you can then fire off curl/wget and pipe the throughput through the secure connection. Since this isn't a TCP forward, it's a TCP connection triggering an application execution which triggers another TCP connection (or series thereof) and then return data over the original TCP connection. It takes a tour through Layer 7 there. It's a lot more clunky to do it that way, but it can be done.