I have a box that runs both an ssh server and a webserver.
- I would like to prevent people with ssh accounts from using this box as an anonymous proxy to the rest of the Internet (e.g. by creating a tunnel and using it as a SOCKS proxy).
- I would like to allow people with ssh accounts to use this box as a proxy to access the local webserver.
So for example:
- Open a tunnel:
ssh -D1234 myhost.com
- Configure the browser to use localhost:1234 as a proxy
- Accessing
myhost.com
through this proxy should work - Accessing any other host through this proxy should fail
I suppose this could be accomplished in a rough way by simply closing outgoing port 80, but this would (a) not prevent people from tunneling non-web traffic, and (b) prevent any user on the box from accessing websites. Is a finer-grained way of doing this, ideally by limiting what sshd will agree to tunnel, possible?