2

I want to be able to offer ssh accounts on my linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling / port forwarding purposes only. My problem is that I don't want them to be able to access services that are bound to localhost only by doing port forwards like the following:

ssh account@server -L 9999:127.0.0.1:3306 & telnet localhost 9999

Would give access to the default mysql database port.. How can I stop this?

I see options in the configuration file for OpenSSH to allow specific ports/hosts, but not to block them. Any help would be greatly appreciated :)

Improve this question
2
  • 1
    Using permitopen="host:port" blocks any host/port that is not mentioned. But what's your rationale for wanting to block this feature?
    – Alex Holst
    Dec 17, 2011 at 10:14
  • I want users to be able to use this as a general proxy service, on whatever port they choose to whatever they choose. The only limitations would be that they cannot connect to the local server resources besides ssh as it's a security risk with no legitimate need for the users to access things like my db server directly. Having to specifically allow big ranges of ports is a last resort, I'd much prefer to block about 10 ports, or any forwarding to localhost specifically
    – Dave Davidson
    Dec 17, 2011 at 10:40

2 Answers 2

Reset to default
2

Sounds like you want permitopen, documented in sshd(8):

 permitopen="host:port"
         Limit local ``ssh -L'' port forwarding such that it may only
         connect to the specified host and port.  IPv6 addresses can be
         specified by enclosing the address in square brackets.  Multiple
         permitopen options may be applied separated by commas.  No
         pattern matching is performed on the specified hostnames, they
         must be literal domains or addresses.
Improve this answer
2
  • Thanks, but as I mentioned in my original question I am aware of this - what I'm looking for is the opposite. Basically wanting to allow connections to any host, except for localhost..
    – Dave Davidson
    Dec 17, 2011 at 14:17
  • OpenSSH does not do this. You need help from your OS. If you're running OpenBSD, pf can block or pass users (or groups) in firewall rules.
    – Alex Holst
    Dec 17, 2011 at 21:19
0

I would try to use iptables, something like this should work out: iptables -A INPUT -d 127.0.0.1 -j DROP You should make a script as well if you want to have your firewall configuration persistent against reboots.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .