I need to setup SSH to block all access to a certain IP on port 555. Only a small group of users should be allowed to tunnel to that IP. Currently I have the following stuff in my sshd_config

Match User bob

The question I have is, how do I deny all other users access to this tunnel? I dont see a denyopen, or restrictopen thing in sshd_config.


You could do it with a firewall on the SSH box:

iptables -A OUTPUT -p tcp -d --dport 555 -m owner --uid-owner bob -j ACCEPT
iptables -A OUTPUT -p tcp -d --dport 555                          -j REJECT
  • Just tested it out, works!. Thanks! – Pratik Amin Mar 15 '11 at 19:58
  • +1 This is even better than the SSH solution which was restricting SSH only, and not programs executed through SSH. – Lekensteyn Mar 15 '11 at 20:37

Disable TcpForwarding for all users by default:

AllowTcpForwarding No

And make an exception for user bob:

Match User bob
        AllowTcpForwarding Yes
  • I think the OP wants to allow tunneling to anywhere other than those. – geekosaur Mar 15 '11 at 18:54
  • From man sshd_config: "PermitOpen: Specifies the destinations to which TCP port forwarding is permitted. [..] An argument of "any" can be used to remove all restrictions and permit any forwarding requests. By default all port forwarding requests are permitted.", this is my interpretation of his question. – Lekensteyn Mar 15 '11 at 18:58
  • Right, but my interpretation is the OP wants PermitOpen ! by default, not AlloqTCPForwarding off. Guess we wait for clarification. – geekosaur Mar 15 '11 at 19:05
  • Sorry, so what I want is: All users to be able to tunnel everywhere EXCEPT for Only certain users should be allowed to tunnel there. The problem with this solution is that if I then do Match User {enter all users here} AllowTCPForwarding Yes They will have access to that IP as well. That being said its still a very good answer :) It might very well need firewall rules on the otherside. – Pratik Amin Mar 15 '11 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.