Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My understanding is when creating an ssh tunnel to a remote machine, the ports become open on that machine for anyone to use and connect back to my local box (not just the user who opened the tunnel). Is there a way to restrict access to the ports opened on the remote machine to a specified unix group? I was thinking this may be possible via an iptables rule or some other TCP/IP port restriction but I am not entirely sure.

Thanks

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You can use the iptables owner module to match the UID or GID of the originating socket, but this only works for packets originating locally (i.e. from the remote machine).

% ssh -fNR 20022:localhost:22 localhost
% sudo iptables --append OUTPUT --destination 127.0.0.1 --protocol tcp --dport 20022 --match owner \! --uid-owner mgorven --jump REJECT
% sudo iptables -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 40 packets, 6349 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            127.0.0.1            tcp dpt:20022 ! owner UID match 1000 reject-with icmp-port-unreachable
% telnet 127.0.0.1 20022
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
^]
telnet> Connection closed.
% sudo telnet 127.0.0.1 20022
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
share|improve this answer
    
That may work fine, as I am trying to prevent random users on the remote machine to access the ports I have opened locally. –  jzalger Jun 12 '12 at 23:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.