We have a linux workstation that is used by a group of users via Internet. For security, users must connect to our private network by VPN and then can ssh to the workstation.
The job they run on the workstation needs Internet connection, so the workstation is connected to Internet via NAT.
However, then it is possible that any normal user can use port forwarding to bypass VPN. For example, by running the following command on the workstation:
ssh -NTf -R 60000:localhost:22 [email protected]
One can then connect to the workstation at public.server:60000. This bypasses VPN and impose a security problem, since anyone can connect to public.server:60000, not just the certain user who run this command. (If only that certain user can use it, I think it would be fine though.)
This is a issue not only for ssh port forwarding. One can also use tools like frp or just write a simple code to achieve this.
I wonder if there's any good measure to solve this issue?
