Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently working on setting up some secure syslog connections between a few Fedora servers. This is my currently setup (syslog-server) <----> (syslog-agent)

From the agent, I am running this command:

ssh -fnNTx -L 1514: syslog_user@

This works just fine. I have rsyslog on the syslog-agent pointing to @@ and it forwards everything to the server correctly on port 514 via the tunnel. My issue is, I want to be able to lock this down. I am going to use ssh keys so this is automated because there will be multiple agents talking to the server. Here are my concerns.

  1. Someone getting on the syslog-agent and logging into the server directly.
    • I have taken care of this by ensuring that syslog_user has a shell of /sbin/nologin so that user can't get a shell at all.
  2. I don't want someone to be able to tunnel another port over ssh. Ex. - 6666:
    • I know my first line of defense against this is to just not have anything listening on those ports and it's not an issue. However I want to be able to lock this down somehow.

Are there any sshd_config settings on the server that I can use to make it where only port 514 can be tunneled over ssh? Are there any other major security concerns I'm overlooking at this point? Thanks in advance for your help/comments.

share|improve this question
Two other alternatives to using ssh for encrypting traffic in such a setup are stunnel, and ipsec. – becomingwisest Apr 4 '12 at 17:18
Yeah, I've used both stunnel and the native IPSEC (setkey) transport mode on Linux to tunnel the syslog traffic. Overall I found that ssh is easier for me to control and easier to roll out on a wide scale. However, I'm always open to trying different IPSEC programs if you think another one would be easier – Eric Apr 4 '12 at 18:12
up vote 1 down vote accepted

There is a sshd option permitopen:

permitopen="host:port" Limit local ``ssh -L'' port forwarding such that it may only connect to the specified host and port. IPv6 addresses can be specified with an alternative syntax: host/port. Multiple permitopen options may be applied separated by commas. No pattern matching is performed on the speci‐ fied hostnames, they must be literal domains or addresses.

share|improve this answer
Thank you for that information. After learning about "PermitOpen" I did some additional Googling and found the following link that has a lot of the information I wanted.… – Eric Apr 4 '12 at 19:21
Works like a champ. On the server I ran added (PermitOpen The client can still connect to the server but they get an "channel 2: open failed: administratively prohibited: open failed" if they try to talk to another port other than 514. – Eric Apr 4 '12 at 19:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.